NULL Pointer Dereference Affecting libgnutls30-hmac-32bit package, versions <3.6.7-150000.6.45.2
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES150-LIBGNUTLS30HMAC32BIT-2986921
- published 18 Aug 2022
- disclosed 17 Aug 2022
Introduced: 17 Aug 2022
CVE-2021-4209 Open this link in a new tabHow to fix?
Upgrade SLES:15.0
libgnutls30-hmac-32bit
to version 3.6.7-150000.6.45.2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libgnutls30-hmac-32bit
package and not the libgnutls30-hmac-32bit
package as distributed by SLES
.
See How to fix?
for SLES:15.0
relevant fixed versions and status.
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
References
- https://www.suse.com/security/cve/CVE-2021-4209.html
- https://lists.suse.com/pipermail/sle-security-updates/2022-August/011930.html
- https://www.suse.com/support/update/announcement/2022/suse-su-20222830-1/
- https://bugzilla.suse.com/1196167
- https://bugzilla.suse.com/1202020
- https://www.suse.com/security/cve/CVE-2021-4209/
- https://www.suse.com/security/cve/CVE-2022-2509/
- https://www.suse.com/support/security/rating/
- https://gitlab.com/gnutls/gnutls/-/issues/1306
- https://access.redhat.com/security/cve/CVE-2021-4209
- https://gitlab.com/gnutls/gnutls/-/merge_requests/1503
- https://bugzilla.redhat.com/show_bug.cgi?id=2044156
- https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568
- https://security.netapp.com/advisory/ntap-20220915-0005/