Riskcovery

CVE-2024-0567

Gnutls: rejects certificate chain with distributed trust

State
Published
Severity
7.5 High
Published
Jan 16, 2024
Updated
Oct 15, 2026
Reserved
Jan 16, 2024

Read the record on cve.org

Description

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

  • CWE-347 Improper Verification of Cryptographic Signature

Affected Products

ProductVersions
gnutls
  • 3.8.0 to before 3.8.3Affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.7.6-23.el9_3.3 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:3.7.6-23.el9_3.3 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat
  • 0:3.7.6-21.el9_2.2 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-37 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-68 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-39 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-58 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-13 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-81 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-79 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-22 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-57 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-6 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-15 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-15 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-54 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-10 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-26 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-19 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-158 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-21 and laterNot affected
RHODF-4.15-RHEL-9Red Hat
  • v4.15.0-103 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-22 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-11 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v6.8.1-407 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-19 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v1.0.0-479 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-7 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v0.4.0-247 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-5 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v1.1.0-227 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.1-470 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v2.9.6-14 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-2 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-24 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v5.8.6-10 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v0.1.0-525 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v0.1.0-224 and laterNot affected
RHOL-5.8-RHEL-9Red Hat
  • v0.28.1-56 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat
      Red Hat Enterprise Linux 7Red Hat
        Red Hat Enterprise Linux 8Red Hat
          Red Hat Enterprise Linux 8Red Hat
            Red Hat Enterprise Linux 9Red Hat
              Red Hat OpenShift Container Platform 3.11Red Hat

                References

                Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.