CVE-2019-3829mediumCWE-416

CVE-2019-3829: medium-severity vulnerability in gnutls

Published · Updated

Follow this CVE+ Monitor gnutls+ Monitor gnutls28

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 59%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
2 products (100 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux BaseOS (v. 8)
fix ↗
Not affected
4 products (13 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5 · Red Hat OpenShift Enterprise 3
A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
gnutls · gnutls
Related CVEs — gnutls

In the same product, most dangerous first.

CVE-2019-3836MEDIUMCVE-2019-3836EPSS 3.4%