CVE-2024-28835

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28835
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28835.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28835
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CLSA (3)
DEBIAN (1)
MGASA (1)
OESA (6)
openSUSE (1)
RHSA (3)
RLSA (1)
SUSE (5)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (5)
Published
2024-03-21T06:13:26Z
Modified
2026-10-23T10:30:54Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Gnutls: potential crash during chain building/verification
Details

A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-248"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28835.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "0:3.7.6-23.el9_3.4"
                        },
                        {
                            "fixed":  "0:3.8.3-4.el9_4"
                        },
                        {
                            "fixed":  "0:3.7.6-23.el9_3.4"
                        },
                        {
                            "fixed":  "0:3.8.3-4.el9_4"
                        },
                        {
                            "fixed":  "0:3.7.6-21.el9_2.3"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / gitlab.com/gnutls/gnutls

Affected ranges

Type
GIT
Repo
https://gitlab.com/gnutls/gnutls
Events
Introduced
2f04c14daa086889b4e85f7056c39d23766ddaa1
Last Affected
2f04c14daa086889b4e85f7056c39d23766ddaa1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.8.3"
                },
                {
                    "last_affected":  "3.8.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

3.*
3.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28835.json"