Gnutls: potential crash during chain building/verification
Summary
| CVE | CVE-2024-28835 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-03-21 06:15:45 UTC |
| Updated | 2026-07-03 03:16:23 UTC |
| Description | A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command. |
Risk And Classification
Primary CVSS: v3.1 5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.003860000 probability, percentile 0.305690000 (date 2026-07-03)
Problem Types: CWE-248 | CWE-248 Uncaught Exception
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
RequiredScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.7.6-23.el9_3.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.8.3-4.el9_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.7.6-23.el9_3.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.8.3-4.el9_4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:3.7.6-21.el9_2.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2024:1879 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2570 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| www.openwall.com/lists/oss-security/2024/03/22/2 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| www.openwall.com/lists/oss-security/2024/03/22/1 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| access.redhat.com/security/cve/CVE-2024-28835 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2889 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | af854a3a-2127-422b-91ae-364da2661108 | lists.gnupg.org | |
| lists.debian.org/debian-lts-announce/2024/09/msg00019.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| security.netapp.com/advisory/ntap-20241122-0009 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-03-11T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-03-21T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.