{"id":"CVE-2024-0567","aliases":["ALPINE-CVE-2024-0567","ALSA-2024:0533","AZL-33340","AZL-34740","BELL-CVE-2024-0567","CLSA-2024-1708029216","CLSA-2024-1708029490","CLSA-2024-1708029936","CLSA-2024-1710184399","CLSA-2024-1734368297","CLSA-2025-1744390816","CLSA-2025-1749479602","DEBIAN-CVE-2024-0567","EUVD-2024-16360","GHSA-mcx8-9rrj-7qxm","JLSEC-2026-526","MGASA-2024-0031","OESA-2024-1090","OESA-2024-1093","OESA-2024-1094","OESA-2024-1095","RHSA-2024:0533","RHSA-2024:1082","SUSE-SU-2024:0638-1","SUSE-SU-2024:0638-2","SUSE-SU-2024:1179-1","UBUNTU-CVE-2024-0567","USN-6593-1","openSUSE-SU-2024:13593-1"],"status":"published","title":"Gnutls: rejects certificate chain with distributed trust","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01392,"percentile":0.72539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2024-01-16T14:01:59Z","modified":"2026-11-05T21:16:09Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"gnutls","fixed_in":["3.7.11-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gnutls","fixed_in":["3.8.3-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"gnutls","fixed_in":["3.7.8-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"gnutls","fixed_in":["3.8.3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls","fixed_in":["3.7.6-21.el9_2.tuxcare.els2","3.7.6-23.el9_2.tuxcare.3.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-c++","fixed_in":["3.7.6-21.el9_2.tuxcare.els2","3.7.6-23.el9_2.tuxcare.3.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-dane","fixed_in":["3.7.6-21.el9_2.tuxcare.els2","3.7.6-23.el9_2.tuxcare.3.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-devel","fixed_in":["3.7.6-21.el9_2.tuxcare.els2","3.7.6-23.el9_2.tuxcare.3.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-utils","fixed_in":["3.7.6-21.el9_2.tuxcare.els2","3.7.6-23.el9_2.tuxcare.3.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gnutls28","fixed_in":["3.7.9-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnutls28","fixed_in":["3.8.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.8.3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"GnuTLS_jll","fixed_in":["3.8.3+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gnutls28","fixed_in":["3.7.3-4ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gnutls28","fixed_in":["3.8.3-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.11-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.8-r2"},{"fixed":"3.7.8-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0-r3"},{"fixed":"3.8.3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.16-4.el8.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-21.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-21.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-21.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-21.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-21.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_2.tuxcare.3.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_2.tuxcare.3.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_2.tuxcare.3.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_2.tuxcare.3.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-23.el9_2.tuxcare.3.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.29-9.el7_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-2+deb12u2"}]}],"versions":["3.7.9-2","3.7.9-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"GnuTLS_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.7.1+0"},{"fixed":"3.8.3+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-11.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-10.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-11.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-11.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-23.el9_3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"gnutls-c++-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"gnutls-dane-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"gnutls-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"gnutls-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.6-21.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.4.41.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-150400.1.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-4ubuntu1.4"}]}],"versions":["3.7.1-5ubuntu1","3.7.2-2ubuntu1","3.7.2-4ubuntu1","3.7.2-5ubuntu1","3.7.3-4ubuntu1","3.7.3-4ubuntu1.1","3.7.3-4ubuntu1.2","3.7.3-4ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1ubuntu1"}]}],"versions":["3.8.1-4ubuntu1","3.8.1-4ubuntu6","3.8.1-4ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.10"}]}],"versions":["3.6.9-5ubuntu1","3.6.9-5ubuntu2","3.6.10-5","3.6.11.1-2","3.6.11.1-2ubuntu2","3.6.13-2ubuntu1","3.6.13-2ubuntu1.1","3.6.13-2ubuntu1.2","3.6.13-2ubuntu1.3","3.6.13-2ubuntu1.6","3.6.13-2ubuntu1.7","3.6.13-2ubuntu1.8","3.6.13-2ubuntu1.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-4ubuntu1.4"}]}],"versions":["3.7.1-5ubuntu1","3.7.2-2ubuntu1","3.7.2-4ubuntu1","3.7.2-5ubuntu1","3.7.3-4ubuntu1","3.7.3-4ubuntu1.1","3.7.3-4ubuntu1.2","3.7.3-4ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"gnutls"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 extended update support"},{"vendor":"red hat","product":"red hat openshift container platform 3.11"},{"vendor":"red hat","product":"rhodf-4.15-rhel-9"},{"vendor":"red hat","product":"rhol-5.8-rhel-9"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:0533","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1082","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1383","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2094","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-0567","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258544","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://gitlab.com/gnutls/gnutls/-/issues/1521","tags":["x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","report","web","article"]},{"url":"https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html","tags":["x_transferred","Mailing List","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/19/3","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240202-0011/","tags":["x_transferred","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0567","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2"},{"url":"https://security.netapp.com/advisory/ntap-20240202-0011"},{"url":"https://github.com/advisories/GHSA-mcx8-9rrj-7qxm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-0567","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5981","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-0553","tags":["report"]},{"url":"https://bugzilla.redhat.com/2248445","tags":["report"]},{"url":"https://bugzilla.redhat.com/2258412","tags":["report"]},{"url":"https://bugzilla.redhat.com/2258544","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-0533.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-0567","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1708029216.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1708029490.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1708029936.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1710184399.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/oraclelinux7-els/CLSA-2024-1734368297.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-fips/CLSA-2025-1744390816.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2025-1749479602.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0567.json","tags":["advisory"]},{"url":"https://gitlab.com/gnutls/gnutls","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-0567","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32755","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/01/19/3","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0553","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1093","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1094","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1095","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258412","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0533.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5981","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5981","tags":["advisory"]},{"url":"https://gnutls.org/security-new.html#GNUTLS-SA-2023-10-23","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-0553","tags":["advisory"]},{"url":"https://gitlab.com/gnutls/gnutls/-/issues/1522","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-0567","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1082.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240638-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218862","tags":["report"]},{"url":"https://bugzilla.suse.com/1218865","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0567","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240638-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202146","tags":["report"]},{"url":"https://bugzilla.suse.com/1203299","tags":["report"]},{"url":"https://bugzilla.suse.com/1203779","tags":["report"]},{"url":"https://bugzilla.suse.com/1207183","tags":["report"]},{"url":"https://bugzilla.suse.com/1207346","tags":["report"]},{"url":"https://bugzilla.suse.com/1208143","tags":["report"]},{"url":"https://bugzilla.suse.com/1208146","tags":["report"]},{"url":"https://bugzilla.suse.com/1208237","tags":["report"]},{"url":"https://bugzilla.suse.com/1209001","tags":["report"]},{"url":"https://bugzilla.suse.com/1217277","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5981","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-0567","tags":["report"]},{"url":"https://gnutls.org/security-new.html#GNUTLS-SA-2024-01-09","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6593-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-0553","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-0567","title":"Gnutls: rejects certificate chain with distributed trust","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:01:59.178Z","modified":"2026-11-05T11:39:11.029Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-05T13:18:22.408512Z"}],"euvd":[{"id":"EUVD-2024-16360","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:01:59Z","modified":"2026-11-05T11:39:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-mcx8-9rrj-7qxm","title":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate...","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T15:30:27Z","modified":"2026-10-15T03:34:12Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2024-0567","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:15:48.527Z","modified":"2026-11-05T12:17:41.837Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-05T16:36:40.983114Z"}],"osv":[{"id":"ALPINE-CVE-2024-0567","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:15:48.527Z","modified":"2026-11-02T11:17:50.048182183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-33340","title":"CVE-2024-0567 affecting package gnutls for versions less than 3.7.11-1","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:15:48Z","modified":"2026-04-21T04:26:48.59291Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34740","title":"CVE-2024-0567 affecting package gnutls for versions less than 3.8.3-1","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:15:48Z","modified":"2026-04-21T04:32:22.758226Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"BELL-CVE-2024-0567","status":"published","published":"2024-01-17T05:57:06.565085Z","modified":"2026-01-26T09:34:44.23065Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-0567","title":"Gnutls: rejects certificate chain with distributed trust","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:01:59.178Z","modified":"2026-11-07T02:30:45.651685424Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-07T03:07:52.010191Z"},{"id":"DEBIAN-CVE-2024-0567","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:15:48.527Z","modified":"2026-11-02T12:00:07.550356388Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"JLSEC-2026-526","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2026-05-26T14:17:50.003Z","modified":"2026-07-18T00:01:00.837233434Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2024-1090","title":"gnutls security update","description":"GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.(CVE-2024-0553)\r\n\r\nA vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.(CVE-2024-0567)","status":"published","published":"2024-01-26T11:06:32Z","modified":"2026-08-18T01:18:13.638764543Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1093","title":"gnutls security update","description":"GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.(CVE-2024-0553)\r\n\r\nA vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.(CVE-2024-0567)","status":"published","published":"2024-01-26T11:06:32Z","modified":"2026-08-18T01:18:13.646766761Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1094","title":"gnutls security update","description":"GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.(CVE-2024-0553)\r\n\r\nA vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.(CVE-2024-0567)","status":"published","published":"2024-01-26T11:06:32Z","modified":"2026-08-18T01:18:13.449146052Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1095","title":"gnutls security update","description":"GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.(CVE-2024-0553)\r\n\r\nA vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.(CVE-2024-0567)","status":"published","published":"2024-01-26T11:06:32Z","modified":"2026-08-18T01:18:13.445132528Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2024:0533","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-16T12:46:50Z","modified":"2026-10-15T10:06:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1082","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-16T12:47:00Z","modified":"2026-10-15T10:07:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2024-0567","description":"A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.","status":"published","published":"2024-01-16T14:15:00Z","modified":"2026-04-22T14:36:12.398385Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2024:0533","title":"Moderate: gnutls security update","description":"The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.\n\nSecurity Fix(es):\n\n* gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)\n* gnutls: incomplete fix for CVE-2023-5981 (CVE-2024-0553)\n* gnutls: rejects certificate chain with distributed trust (CVE-2024-0567)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-01-29T00:00:00Z","modified":"2026-10-29T11:31:41.1385709Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2024-1708029216","title":"gnutls: Fix of 3 CVEs","description":"- Add CVE-2024-0567 PoC test\n- Remove src.rpm from sources\n- CVE-2023-5981: removes branching that depends on secret data to\n  prevent potential side-channel attack\n- CVE-2024-0553: minimize branching after decryption","status":"published","published":"2024-02-15T20:33:39Z","modified":"2026-10-21T10:46:36.303930659Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1708029490","title":"gnutls: Fix of 3 CVEs","description":"- Add CVE-2024-0567 PoC test\n- Remove src.rpm from sources\n- CVE-2023-5981: removes branching that depends on secret data to\n  prevent potential side-channel attack\n- CVE-2024-0553: minimize branching after decryption","status":"published","published":"2024-02-15T20:38:13Z","modified":"2026-10-21T10:45:10.991574209Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1708029936","title":"gnutls: Fix of CVE-2024-0567","description":"- CVE-2024-0567: x509: detect loop in certificate chain","status":"published","published":"2024-02-15T20:45:39Z","modified":"2026-06-01T00:30:16.248321792Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1710184399","title":"gnutls: Fix of 3 CVEs","description":"- Keep the broken pkcs11 tests disabled.\n- Added CVE-2024-0567 PoC test.\n- CVE-2023-5981-pre1: improve level of randomness for each operations,\n  always use _gnutls_switch_lib_state for pk wrappers.\n- CVE-2023-5981-pre2: add constant time/cache operations to prevent\n  or minimaze timining or cache side channel attacks.\n- CVE-2023-5981: removes branching that depends on secret data to\n  prevent potential side-channel attack.\n- CVE-2024-0553: minimize branching after decryption.","status":"published","published":"2024-03-11T19:13:22Z","modified":"2026-10-21T10:47:53.213326094Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1734368297","title":"gnutls: Fix of 3 CVEs","description":"- Keep the broken pkcs11 tests disabled.\n- Added CVE-2024-0567 PoC test.\n- CVE-2023-5981-pre1: improve level of randomness for each operations,\n  always use _gnutls_switch_lib_state for pk wrappers.\n- CVE-2023-5981-pre2: add constant time/cache operations to prevent\n  or minimaze timining or cache side channel attacks.\n- CVE-2023-5981: removes branching that depends on secret data to\n  prevent potential side-channel attack.\n- CVE-2024-0553: minimize branching after decryption.","status":"published","published":"2024-12-16T16:58:23Z","modified":"2026-10-21T10:48:18.469917227Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1744390816","title":"gnutls: Fix of CVE-2024-0567","description":"- CVE-2024-0567: detect loop in certificate chain","status":"published","published":"2025-04-11T17:00:21Z","modified":"2026-06-01T00:30:40.531432635Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1749479602","title":"gnutls: Fix of 3 CVEs","description":"- Keep the broken pkcs11 tests disabled.\n- Added CVE-2024-0567 PoC test.\n- CVE-2023-5981-pre1: improve level of randomness for each operations,\n  always use _gnutls_switch_lib_state for pk wrappers.\n- CVE-2023-5981-pre2: add constant time/cache operations to prevent\n  or minimaze timining or cache side channel attacks.\n- CVE-2023-5981: removes branching that depends on secret data to\n  prevent potential side-channel attack.\n- CVE-2024-0553: minimize branching after decryption.","status":"published","published":"2025-06-09T14:33:27Z","modified":"2026-10-21T10:48:13.745762143Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"MGASA-2024-0031","title":"Updated gnutls packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nA vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS)\nrejects a certificate chain with distributed trust. This issue occurs\nwhen validating a certificate chain with cockpit-certificate-ensure.\nThis flaw allows an unauthenticated, remote client or attacker to\ninitiate a denial of service attack. (CVE-2024-0567)\nA vulnerability was found in GnuTLS. The response times to malformed\nciphertexts in RSA-PSK ClientKeyExchange differ from response times of\nciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a\nremote attacker to perform a timing side-channel attack in the RSA-PSK\nkey exchange, potentially leading to the leakage of sensitive data.\nCVE-2024-0553 is designated as an incomplete resolution for\nCVE-2023-5981. (CVE-2024-0553)\n","status":"published","published":"2024-02-09T01:34:03Z","modified":"2026-04-16T04:42:56.931949681Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13593-1","title":"gnutls-3.8.3-1.1 on GA media","description":"These are all security issues fixed in the gnutls-3.8.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:07.051153Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0638-1","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2024-0567: Fixed an incorrect rejection of certificate chains\n  with distributed trust (bsc#1218862).\n- CVE-2024-0553: Fixed a timing attack against the RSA-PSK key\n  exchange, which could lead to the leakage of sensitive data\n  (bsc#1218865).\n","status":"published","published":"2024-02-27T09:36:12Z","modified":"2026-02-04T04:24:02.682284Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0638-2","title":"Security update for gnutls","description":"This update for gnutls fixes the following issues:\n\n- CVE-2024-0567: Fixed an incorrect rejection of certificate chains\n  with distributed trust (bsc#1218862).\n- CVE-2024-0553: Fixed a timing attack against the RSA-PSK key\n  exchange, which could lead to the leakage of sensitive data\n  (bsc#1218865).\n","status":"published","published":"2024-05-13T10:02:32Z","modified":"2026-02-04T03:38:52.383313Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1179-1","title":"Security update for gnutls","description":"\nThis update for gnutls fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange (bsc#1208143).\n- CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).\n- CVE-2024-0567: Fixed an incorrect rejection of certificate chains\n  with distributed trust (bsc#1218862).\n- CVE-2024-0553: Fixed a timing attack against the RSA-PSK key\n  exchange, which could lead to the leakage of sensitive data\n  (bsc#1218865).\n\nFIPS 140-3 certification related bugs fixed:\n\n- FIPS: Set error state when jent init failed in FIPS mode (bsc#1202146)\n- FIPS: Make XTS key check failure not fatal (bsc#1203779)\n- FIPS: Added GnuTLS DH/ECDH pairwise consistency check for public key regeneration [bsc#1207183]\n- FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346]\n- FIPS: Make the jitterentropy calls thread-safe (bsc#1208146).\n- FIPS: GnuTLS DH/ECDH PCT public key regeneration (bsc#1207183).\n- FIPS: Fix pct_test() return code in case of error (bsc#1207183)\n- FIPS: Establish PBKDF2 additional requirements [bsc#1209001]\n\n  * Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N)\n  * Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1)\n  * Set the minimum iterations count to 1000 (SP 800-132 sec 5.2)\n  * Set the minimum passlen of 20 characters (SP SP800-132 sec 5)\n  * Add regression tests for the new PBKDF2 requirements.\n\nOther issues fixed:\n\n- Fix AVX CPU feature detection for OSXSAVE (bsc#1203299)\n  This fixes a SIGILL termination at the verzoupper instruction when\n  trying to run GnuTLS on a Linux kernel with the noxsave command\n  line parameter set. Relevant mostly for virtual systems.\n- Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562]\n","status":"published","published":"2024-04-09T16:08:45Z","modified":"2025-05-02T04:34:08.411292Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-6593-1","title":"gnutls28 vulnerabilities","description":"It was discovered that GnuTLS had a timing side-channel when processing\nmalformed ciphertexts in RSA-PSK ClientKeyExchange. A remote attacker could\npossibly use this issue to recover sensitive information. (CVE-2024-0553)\n\nIt was discovered that GnuTLS incorrectly handled certain certificate\nchains with a cross-signing loop. A remote attacker could possibly use this\nissue to cause GnuTLS to crash, resulting in a denial of service. This\nissue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10.\n(CVE-2024-0567)\n","status":"published","published":"2024-01-22T13:16:42Z","modified":"2026-04-27T17:17:24.897604292Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}