Confidentiality Vulnerability in GnuTLS Products by GnuTLS
CVE-2020-13777
7.4HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2020-13777?
GnuTLS versions prior to 3.6.14 are affected by a cryptographic vulnerability that leads to loss of confidentiality in TLS 1.2 and an authentication bypass in TLS 1.3 due to incorrect session ticket encryption. This problem originates from a commit made in September 2018. Until the first key rotation occurs, the TLS server substitutes erroneous data instead of a properly derived encryption key from the application, exposing the session's sensitive information.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.