GnuTLS: Denial of service A flaw was found in GnuTLS, possibly allowing a Denial of Service condition. gnutls 2020-09-06 2020-09-06 740390 local, remote 3.6.15 3.6.15

GnuTLS is an Open Source implementation of the TLS and SSL protocols.

It was found that GnuTLS didn’t handle “no_renegotiation” alert properly.

A remote attacker could entice a user to connect to a malicious TLS endpoint using an application linked against GnuTLS, possibly resulting in a Denial of Service condition.

There is no known workaround at this time.

All GnuTLS users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/gnutls-3.6.15"
CVE-2020-24659 sam_c sam_c