What’s Vulnerable › Vulnerabilities
CVE-2020-13777
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 22.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-06-04 · updated 2026-10-14
- Weakness: CWE-327
Description
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application.
Affected products
- Canonical Ubuntu Linux: 19.10, 20.04
- Debian Linux: 10.0
- Fedoraproject Fedora: 31, 32
- [UNKNOWN] gnutls: from 3.6.0 before 3.6.14 — fixed in 3.6.14
How to fix
Upgrade to a fixed version: [UNKNOWN] gnutls 3.6.14. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html
- https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6C4DHUKV6M6SJ5CV6KVHZNHNF7HCUE5P/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RTXZOXC4MHTFE2HKY6IAZMF2WHD2WMV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRQBFK3UZ7SV76IYDTS4PS6ABS2DSJHK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMB3UGI5H5RCFRU6OGRPMNUCNLJGEN7Y/
- https://security.gentoo.org/glsa/202006-01
- https://security.netapp.com/advisory/ntap-20200619-0004/
- https://usn.ubuntu.com/4384-1/
- https://www.debian.org/security/2020/dsa-4697
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html
- https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03
Get alerted when CVE-2020-13777 or the next vulnerability affects your stack