CVE-2024-0567: Gnutls: rejects certificate chain with distributed trust

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-16 · updated 2026-10-15
Weakness: CWE-347

Description

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

Affected products

Debian Linux: 11.0
Fedoraproject Fedora: 38, 39
[UNKNOWN] gnutls: from 3.7.0 before 3.8.3 — fixed in 3.8.3
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions

How to fix

Upgrade to a fixed version: [UNKNOWN] gnutls 3.8.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-0567 or the next vulnerability affects your stack