Fluid Attacks Database

Description

The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	gnutls	<0:1.4.1-10.el5_9.2	0:1.4.1-10.el5_9.2
rpm rhel6	gnutls	<0:2.8.5-10.el6_4.2	0:2.8.5-10.el6_4.2

Aliases

1. CVE-2013-21162. NVD-2013-21163. OSV-2013-2116

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.