Lucene search

K
freebsdFreeBSD1CD0C17A-17C0-11ED-91A5-080027F5FEC9
HistoryJul 07, 2022 - 12:00 a.m.

gnutls -- double free vulnerability

2022-07-0700:00:00
vuxml.freebsd.org
10

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.0%

The GnuTLS project reports:

    When gnutls_pkcs7_verify cannot verify signature against
    given trust list, it starts creating a chain of
    certificates starting from identified signer up to known
    root. During the creation of this chain the signer
    certificate gets freed which results in double free when
    the same signer certificate is freed at the end of the
    algorithm.
OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchgnutls= 3.6.0UNKNOWN
FreeBSDanynoarchgnutls< 3.7.7UNKNOWN

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.0%