Insecure generation of random numbers In gnutls
Description
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.19 | 3.6.13-r0 | ||
alpine v3.9 | 3.6.7-r1 | ||
 debian 11 | 3.6.13-2 | ||
debian 12 | 3.6.13-2 | ||
debian 14 | 3.6.13-2 | ||
alpine v3.10 | 3.6.8-r1 | ||
alpine v3.12 | 3.6.13-r0 | ||
alpine v3.13 | 3.6.13-r0 | ||
alpine v3.14 | 3.6.13-r0 | ||
alpine v3.15 | 3.6.13-r0 |
1-10 of 21
10
Aliases
1. 2. 3. 4. 5. 6. 7.