Vulnerability Name:

CVE-2021-20231 (CCN-198173)

Assigned:2020-12-17
Published:2021-03-12
Updated:2021-06-01
Summary:A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): High
3.7 Low (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
3.2 Low (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.1 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-416
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-20231

Source: CCN
Type: Red Hat Bugzilla – Bug 1922276
(CVE-2021-20231) - CVE-2021-20231 gnutls: Use after free in client key_share extension

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1922276

Source: XF
Type: UNKNOWN
gnutls-cve202120231-dos(198173)

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210429 [jira] [Commented] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210423 [jira] [Resolved] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210413 [jira] [Created] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210430 [jira] [Commented] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210425 [jira] [Commented] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210417 [jira] [Commented] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210426 [jira] [Updated] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: MLIST
Type: Mailing List, Third Party Advisory
[spark-issues] 20210426 [jira] [Commented] (SPARK-35054) Getting Critical Vulnerability CVE-2021-20231 on spark 3.0.0 branch

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-18bef34f05

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210416-0005/

Source: CCN
Type: GNUTLS-SA-2021-03-10
GnuTLS

Source: MISC
Type: Exploit, Vendor Advisory
https://www.gnutls.org/security-new.html#GNUTLS-SA-2021-03-10

Source: CCN
Type: IBM Security Bulletin 6541298 (Cloud Pak for Automation)
Multiple security vulnerabilities fixed in Cloud Pak for Automation components

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Source: CCN
Type: IBM Security Bulletin 6560126 (Sterling Connect:Direct for UNIX Certified Container)
IBM Sterling Connect:Direct for UNIX Certified Container is affected by multiple vulnerabilities in Red Hat Universal Base Image version 8.4-206.1626828523 and Binutils version 2.30-93

Source: CCN
Type: IBM Security Bulletin 6574787 (QRadar SIEM)
IBM QRadar SIEM is vulnerable to using components with Known Vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6605839 (Security Verify Governance)
Multiple security vulnerabilities found in open source code that is shipped with IBM Security Verify Governance, Identity Manager virtual appliance component

Source: CCN
Type: IBM Security Bulletin 6854981 (Cloud Pak for Security)
IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:gnutls:*:*:*:*:*:*:*:* (Version >= 3.6.3 and < 3.7.1)

  • Configuration 2:
  • cpe:/o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

  • Configuration 3:
  • cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*

  • Configuration 4:
  • cpe:/a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • OR cpe:/a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*

  • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

  • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

  • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

  • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:gnu:gnutls:-:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:qradar_security_information_and_event_manager:7.3.3:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.2:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.3:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.10.6.0:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7512
    P
    gnutls-3.7.3-150400.4.35.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3583
    P
    libcroco-0_6-3-0.6.11-12.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:2937
    P
    gnutls-3.7.3-150400.2.12 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94695
    P
    libpython3_6m1_0-3.6.15-150300.10.21.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94567
    P
    gnutls-3.7.3-150400.2.12 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:70
    P
    gnutls-3.6.7-14.10.2 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:102245
    P
    Security update for pgadmin4 (Important) (in QA)
    2022-04-14
    oval:org.opensuse.security:def:99222
    P
    (Important)
    2022-03-08
    oval:org.opensuse.security:def:999
    P
    Security update for containerd (Moderate)
    2022-03-04
    oval:com.redhat.rhsa:def:20214451
    P
    RHSA-2021:4451: gnutls and nettle security, bug fix, and enhancement update (Moderate)
    2021-11-09
    oval:org.opensuse.security:def:99420
    P
    (Important)
    2021-10-12
    oval:org.opensuse.security:def:101408
    P
    uuidd-2.36.2-2.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:100846
    P
    gnutls-3.6.7-14.10.2 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62088
    P
    gnutls-3.6.7-14.10.2 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71829
    P
    gnutls-3.6.7-14.10.2 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:5984
    P
    Security update for openssl-1_1 (Important)
    2021-03-25
    oval:org.opensuse.security:def:111287
    P
    Security update for gnutls (Important)
    2021-03-25
    oval:org.opensuse.security:def:64672
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:117588
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:9869
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:100385
    P
    (Important)
    2021-03-24
    oval:org.opensuse.security:def:97333
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:92868
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:70009
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:73794
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:9111
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:100130
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:108074
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:92272
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:67073
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:10227
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:100718
    P
    (Important)
    2021-03-24
    oval:org.opensuse.security:def:97334
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:93027
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:70367
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:76141
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:42161
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:9473
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:108911
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:95532
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:92470
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:69613
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:10420
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:8723
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:99619
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:93180
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:70560
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:9670
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:99027
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:92669
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:69810
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:8916
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:99818
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:93333
    P
    Security update for gnutls (Important)
    2021-03-24
    oval:org.opensuse.security:def:92077
    P
    Security update for gnutls (Important)
    2021-03-24
    BACK
    gnu gnutls *
    redhat enterprise linux 8.0
    fedoraproject fedora 34
    netapp active iq unified manager -
    netapp e-series performance analyzer -
    gnu gnutls -
    ibm qradar security information and event manager 7.3.3
    ibm cloud pak for automation 21.0.1
    ibm cloud pak for automation 21.0.2 -
    ibm qradar security information and event manager 7.4.3 -
    ibm cloud pak for security 1.7.2.0
    ibm qradar security information and event manager 7.5.0 -
    ibm cloud pak for security 1.10.0.0
    ibm cloud pak for security 1.10.6.0