Gnutls: rejects certificate chain with distributed trust
Summary
| CVE | CVE-2024-0567 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-16 14:15:48 UTC |
| Updated | 2026-10-15 01:17:17 UTC |
| Description | A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-347 | CWE-347 Improper Verification of Cryptographic Signature
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 38 | All | All | All |
| Operating System | Fedoraproject | Fedora | 39 | All | All | All |
| Application | Gnu | Gnutls | All | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.7.6-23.el9_3.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.7.6-23.el9_3.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:3.7.6-21.el9_2.2 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-37 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-68 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-39 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-58 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-13 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-81 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-79 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-22 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-57 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-6 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-15 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-15 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-54 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-10 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-26 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-19 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-21 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-103 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-22 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-11 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v6.8.1-407 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-19 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v1.0.0-479 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-7 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.4.0-247 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-5 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v1.1.0-227 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.1-470 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v2.9.6-14 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-2 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-24 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-10 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.1.0-525 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.1.0-224 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.28.1-56 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenShift Container Platform 3.11 | Not specified | Not specified |
| ADP | Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux Subsystem | affected V1.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2024:1383 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:1082 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| January 2024 GnuTLS Vulnerabilities in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| access.redhat.com/errata/RHSA-2024:2094 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| oss-security - GnuTLS 3.8.3 released, fixes CVE-2024-0553 & CVE-2024-0567 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Red Hat | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| [SECURITY] Fedora 39 Update: gnutls-3.8.3-1.fc39 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| cve-details | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| cockpit-certificate-ensure: ../../../lib/x509/common.c:1756: _gnutls_sort_clist: Assertion `k == clist_size' failed. (#1521) · Issues · gnutls / GnuTLS · GitLab | af854a3a-2127-422b-91ae-364da2661108 | gitlab.com | Exploit, Issue Tracking, Patch, Vendor Advisory |
| cert-portal.siemens.com/productcert/html/ssa-794697.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| 2258544 – (CVE-2024-0567) CVE-2024-0567 gnutls: rejects certificate chain with distributed trust | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Exploit, Issue Tracking, Third Party Advisory |
| [gnutls-help] gnutls 3.8.3 | af854a3a-2127-422b-91ae-364da2661108 | lists.gnupg.org | Mailing List |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-01-16T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-01-16T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 161336 Oracle Enterprise Linux Security Update for gnutls (ELSA-2024-0533)
- 200059 Ubuntu Security Notification for GnuTLS Vulnerabilities (USN-6593-1)
- 242768 Red Hat Update for gnutls (RHSA-2024:0533)
- 243014 Red Hat Update for gnutls (RHSA-2024:1082)
- 284905 Fedora Security Update for gnutls (FEDORA-2024-c43a6cc3f8)
- 285017 Fedora Security Update for gnutls (FEDORA-2024-80428c408c)
- 357250 Amazon Linux Security Advisory for gnutls : ALAS2023-2024-521
- 510684 Alpine Linux Security Update for gnutls
- 673852 EulerOS Security Update for gnutls (EulerOS-SA-2024-1213)
- 673958 EulerOS Security Update for gnutls (EulerOS-SA-2024-1235)
- 755847 SUSE Enterprise Linux Security Update for gnutls (SUSE-SU-2024:0638-1)
- 908027 Common Base Linux Mariner (CBL-Mariner) Security Update for gnutls (33340)
- 908067 Common Base Linux Mariner (CBL-Mariner) Security Update for gnutls (33340-1)
- 941558 AlmaLinux Security Update for gnutls (ALSA-2024:0533)