CVE-2019-3836
Published: 1 April 2019
It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.
Notes
| Author | Note |
|---|---|
| mdeslaur | 3.6.4 and later |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
gnutls26 Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
| trusty |
Not vulnerable
(code not present)
|
|
| xenial |
Does not exist
|
|
| bionic |
Does not exist
|
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
|
gnutls28 Launchpad, Ubuntu, Debian |
upstream |
Released
(3.6.7)
|
| trusty |
Does not exist
(trusty was not-affected [code not present])
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| bionic |
Not vulnerable
(code not present)
|
|
| cosmic |
Released
(3.6.4-2ubuntu1.2)
|
|
| disco |
Released
(3.6.5-2ubuntu1.1)
|
|
|
Patches: upstream: https://gitlab.com/gnutls/gnutls/commit/96e07075e8f105b13e76b11e493d5aa2dd937226 (3.6) |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |