Insecure Cryptography in GnuTLS Affects Multiple Versions
CVE-2020-11501

7.4HIGH

Key Information:

Vendor: Gnu
Status: Gnutls
Vendor: CVE Published:; 3 April 2020

What is CVE-2020-11501?

GnuTLS prior to version 3.6.13 has a cryptographic flaw in its implementation of the DTLS protocol. Due to an error introduced in a past commit, the DTLS client resorts to using a predetermined sequence of 32 null bytes instead of a sufficiently random value. This lack of randomness undermines the security assurances of DTLS, making it easier for potential attacks to predict session parameters and compromise communications.