Insecure Cryptography in GnuTLS Affects Multiple Versions
CVE-2020-11501
7.4HIGH
Summary
GnuTLS prior to version 3.6.13 has a cryptographic flaw in its implementation of the DTLS protocol. Due to an error introduced in a past commit, the DTLS client resorts to using a predetermined sequence of 32 null bytes instead of a sufficiently random value. This lack of randomness undermines the security assurances of DTLS, making it easier for potential attacks to predict session parameters and compromise communications.
References
CVSS V3.1
Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved