{"id":"CVE-2020-13777","aliases":["ALPINE-CVE-2020-13777","BELL-CVE-2020-13777","DEBIAN-CVE-2020-13777","DSA-4697-1","EUVD-2020-5994","GHSA-cv49-m792-xmjv","JLSEC-2026-518","MGASA-2020-0268","RHSA-2020:2637","RHSA-2020:2638","RHSA-2020:2639","SUSE-SU-2020:1584-1","UBUNTU-CVE-2020-13777","USN-4384-1","openSUSE-SU-2020:0790-1","openSUSE-SU-2024:10801-1"],"status":"published","title":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of...","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.22455,"percentile":0.97731,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-327"],"published":"2020-06-04T07:01:07Z","modified":"2026-10-26T12:00:34Z","exploits":[{"source":"pocgithub","id":"0xxon/cve-2020-13777","title":"0xxon/cve-2020-13777","date":"2020-06-09","url":"https://github.com/0xxon/cve-2020-13777"},{"source":"pocgithub","id":"shigeki/challenge_CVE-2020-13777","title":"shigeki/challenge_CVE-2020-13777","date":"2020-06-12","url":"https://github.com/shigeki/challenge_CVE-2020-13777"},{"source":"pocgithub","id":"prprhyt/PoC_TLS1_3_CVE-2020-13777","title":"prprhyt/PoC_TLS1_3_CVE-2020-13777","date":"2020-06-21","url":"https://github.com/prprhyt/PoC_TLS1_3_CVE-2020-13777"}],"fixes":[{"ecosystem":"Alpine:v3.10","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"gnutls","fixed_in":["3.6.14-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gnutls28","fixed_in":["3.6.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnutls28","fixed_in":["3.6.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.6.14-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"gnutls28","fixed_in":["3.6.7-4+deb10u4"],"sources":["osv"]},{"ecosystem":"Julia","package":"GnuTLS_jll","fixed_in":["3.7.1+0"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"gnutls","fixed_in":["3.6.14-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-c++","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-c++-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-dane","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-dane-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-debugsource","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-devel","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-utils","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-utils-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-c++-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-dane-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-debugsource","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-utils-debuginfo","fixed_in":["0:3.6.8-11.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-c++","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-c++-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-dane","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-dane-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-debugsource","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-devel","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-utils","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-utils-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-c++-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-dane-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-debugsource","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-utils-debuginfo","fixed_in":["0:3.6.8-9.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-c++","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-c++-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-dane","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-dane-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-debugsource","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-devel","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-utils","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-utils-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-c++-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-dane-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-debugsource","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-utils-debuginfo","fixed_in":["0:3.6.5-3.el8_0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"gnutls","fixed_in":["3.6.7-6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"gnutls","fixed_in":["3.6.7-6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"gnutls","fixed_in":["3.6.7-6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"gnutls","fixed_in":["3.6.7-6.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"gnutls","fixed_in":["3.6.7-6.29.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gnutls28","fixed_in":["3.6.13-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"gnutls","fixed_in":["3.6.7-lp151.2.18.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.14-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.14-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-4+deb10u4"}]}],"versions":["3.6.7-4","3.6.7-4+deb10u1","3.6.7-4+deb10u2","3.6.7-4+deb10u3"]},{"source":"osv","ecosystem":"Julia","package":"GnuTLS_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.14-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-11.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::baseos","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.8-9.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::baseos","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.5-3.el8_0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6.29.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.1"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.1"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-lp151.2.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-1.2"}]}],"bundled":11}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"gnutls"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://www.debian.org/security/2020/dsa-4697","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMB3UGI5H5RCFRU6OGRPMNUCNLJGEN7Y/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202006-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4384-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6C4DHUKV6M6SJ5CV6KVHZNHNF7HCUE5P/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRQBFK3UZ7SV76IYDTS4PS6ABS2DSJHK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RTXZOXC4MHTFE2HKY6IAZMF2WHD2WMV/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200619-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13777","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6C4DHUKV6M6SJ5CV6KVHZNHNF7HCUE5P"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RTXZOXC4MHTFE2HKY6IAZMF2WHD2WMV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRQBFK3UZ7SV76IYDTS4PS6ABS2DSJHK"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMB3UGI5H5RCFRU6OGRPMNUCNLJGEN7Y"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6C4DHUKV6M6SJ5CV6KVHZNHNF7HCUE5P"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RTXZOXC4MHTFE2HKY6IAZMF2WHD2WMV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRQBFK3UZ7SV76IYDTS4PS6ABS2DSJHK"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMB3UGI5H5RCFRU6OGRPMNUCNLJGEN7Y"},{"url":"https://security.netapp.com/advisory/ntap-20200619-0004"},{"url":"https://usn.ubuntu.com/4384-1"},{"url":"https://github.com/advisories/GHSA-cv49-m792-xmjv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13777","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-13777","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13777","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0268.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26749","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2637","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843723","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2637.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13777","tags":["advisory","report"]},{"url":"https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-06-03","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2638","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2638.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2639","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2639.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201584-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172461","tags":["report"]},{"url":"https://bugzilla.suse.com/1172506","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13777","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-13777","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4384-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7AWWZAFHM4X4VDC2SELE3F2YGHU6D3KT/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-4790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20232","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2020-06-04T07:01:07Z","modified":"2026-10-14T09:23:40.445Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2020-5994","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2020-06-04T07:01:07Z","modified":"2026-10-14T09:23:40Z","updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-cv49-m792-xmjv","title":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of...","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2022-05-24T17:19:17Z","modified":"2026-10-14T12:32:22Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2020-06-04T07:15:10Z","modified":"2026-10-14T10:17:29.13Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"ALPINE-CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2020-06-04T07:15:10Z","modified":"2026-10-26T11:17:55.113440233Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-13777","title":"CVE-2020-13777 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:13.135363Z","modified":"2026-01-26T09:48:28.841489Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2020-06-04T07:15:10Z","modified":"2026-10-25T02:45:05.522606817Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2020-06-04T07:15:10Z","modified":"2026-10-26T12:00:34.409084485Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"JLSEC-2026-518","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2026-05-26T14:17:50.003Z","modified":"2026-07-18T00:00:50.376500103Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2020:2637","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-16T04:30:30Z","modified":"2026-10-15T10:01:36Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2638","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-16T04:30:38Z","modified":"2026-10-15T10:01:37Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2639","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-16T04:30:45Z","modified":"2026-10-15T10:01:38Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.","status":"published","published":"2020-06-04T07:15:00Z","modified":"2026-04-22T12:28:50.328629Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"DSA-4697-1","title":"gnutls28 - security update","status":"published","published":"2020-06-06T00:00:00Z","modified":"2026-03-09T02:10:36.765649Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0268","title":"Updated gnutls packages fix security vulnerability","description":"Updated gnutls packages fix security vulnerability:\n\nIt was found that GnuTLS 3.6.4 introduced a regression in the TLS\nprotocol implementation. This caused the TLS server to not securely\nconstruct a session ticket encryption key considering the application\nsupplied secret, allowing a MitM attacker to bypass authentication in\nTLS 1.3 and recover previous conversations in TLS 1.2 (CVE-2020-13777).\n","status":"published","published":"2020-06-20T22:45:09Z","modified":"2026-04-16T04:42:37.543979809Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0790-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2020-13777: Fixed an insecure session ticket key construction which could \n  have made the TLS server to not bind the session ticket encryption key with a\n  value supplied by the application until the initial key rotation, allowing\n  an attacker to bypass authentication in TLS 1.3 and recover previous\n  conversations in TLS 1.2 (bsc#1172506).\n- Fixed an  improper handling of certificate chain with cross-signed intermediate\n  CA certificates (bsc#1172461).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-10T17:41:13Z","modified":"2026-02-04T02:26:46.746134Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10801-1","title":"gnutls-3.7.2-1.2 on GA media","description":"These are all security issues fixed in the gnutls-3.7.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:36:06.109989Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:1584-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2020-13777: Fixed an insecure session ticket key construction which could \n  have made the TLS server to not bind the session ticket encryption key with a\n  value supplied by the application until the initial key rotation, allowing\n  an attacker to bypass authentication in TLS 1.3 and recover previous\n  conversations in TLS 1.2 (bsc#1172506).\n- Fixed an  improper handling of certificate chain with cross-signed intermediate\n  CA certificates (bsc#1172461).\n","status":"published","published":"2020-06-09T16:39:44Z","modified":"2026-02-04T03:02:02.85353Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4384-1","title":"gnutls28 vulnerability","description":"It was discovered that GnuTLS incorrectly handled session ticket encryption\nkeys. A remote attacker could possibly use this issue to bypass\nauthentication or recover sensitive information.\n","status":"published","published":"2020-06-05T17:09:26Z","modified":"2026-04-22T10:05:41.577355Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}