CVE-2020-24659
- State
- Published
- Severity
- Not scored
- Published
- Sep 4, 2020
- Updated
- Oct 14, 2026
- Reserved
- Aug 26, 2020
Description
An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://gitlab.com/gnutls/gnutls/-/issues/1071
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-09-04
- GLSA-202009-01vendor-advisory
- https://security.netapp.com/advisory/ntap-20200911-0006/
- FEDORA-2020-0ab6656303vendor-advisory
- USN-4491-1vendor-advisory
- FEDORA-2020-de51ee7cc9vendor-advisory
- openSUSE-SU-2020:1724vendor-advisory
- openSUSE-SU-2020:1743vendor-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.