According to the version of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in GnuTLS before 3.6.15. A     server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with     unexpected timing, and then an invalid second handshake     occurs. The crash happens in the application's error     handling path, where the gnutls_deinit function is     called after detecting a handshake     failure.(CVE-2020-24659)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnutls fixes the following issues :

Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181)

FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)

FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)

FIPS: Add TLS KDF selftest (bsc#1176671)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5483 advisory.

    [3.6.14-7]
    - Increase DH key bits to >= 2048 in self-tests (#1879506)
    - Implement self-tests for KDF and CMAC (#1890870)
    - Fix CVE-2020-24659: heap buffer-overflow when 'no_renegotiation' alert is received (#1873959)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2020:2864-2 advisory.

    - Fix heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659 bsc#1176181)
    - FIPS: Implement (EC)DH requirements from SP800-56Arev3 (bsc#1176086)
    - FIPS: Use 2048 bit prime in DH selftest (bsc#1176086)
    - FIPS: Add TLS KDF selftest (bsc#1176671)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the gnutls package has been released.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0008 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-3829:
    A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free)     vulnerability in the certificate verification API. Any client or server application that verifies X.509     certificates with GnuTLS 3.5.8 or later is affected.

    CVE-2019-3836:
    It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in     gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

    CVE-2020-11501:
    GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3     (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead     of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security     guarantees of the DTLS protocol.

    CVE-2020-13777:
    GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of     confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is     3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS     server always uses wrong data in place of an encryption key derived from an application.

    CVE-2020-24659:
    An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
142203	EulerOS 2.0 SP8 : gnutls (EulerOS-SA-2020-2310)	Nessus	Huawei Local Security Checks	2020/11/2	2024/2/12	high
143866	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2020:2864-1)	Nessus	SuSE Local Security Checks	2020/12/9	2024/2/5	high
144508	Oracle Linux 8 : gnutls (ELSA-2020-5483)	Nessus	Oracle Linux Local Security Checks	2020/12/21	2024/11/1	high
163244	SUSE SLES15: gnutls / libgnutls-devel / libgnutls-devel-32bit / libgnutls30 / etc (SUSE-SU-2020:2864-2)	Nessus	SuSE Local Security Checks	2022/7/15	2026/6/25	high
141444	Photon OS 2.0: Gnutls PHSA-2020-2.0-0288	Nessus	PhotonOS Local Security Checks	2020/10/14	2024/7/23	high
236485	Alibaba Cloud Linux 3 : 0008: gnutls (ALINUX3-SA-2021:0008)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high

检测

插件搜索

high

high

high

high

high

high