crítica
CVE-2021-20232
gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, CBL-Mariner, Julia, Photon OS. Más baja según Red Hat (media), AlmaLinux (media), Oracle (media), Rocky Linux (media), Ubuntu (baja).
Descripción
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 1.0 | gnutls | 0:3.6.14-5.cm1 |
| CBL-Mariner 2.0 | gnutls | 0:3.6.14-5.cm2 |
| julia::Julia Ecosystem Security Advisories | GnuTLS_jll | 3.7.1+0 |
| Photon OS 1.0 | gnutls | 3.6.15-3.ph1 |
| Photon OS 2.0 | gnutls | 3.6.15-3.ph2 |
| Photon OS 3.0 | gnutls | 3.6.15-3.ph3 |
| Photon OS 4.0 | gnutls, gnutls-devel | 3.7.1-1.ph4 |
| alma 8 | gnutls, gnutls-c++, gnutls-dane y 4 más | 3.6.16-4.el8 y 1 más |
| alpine 3.10 | gnutls | 3.6.15-r1 |
| alpine 3.11 | gnutls | 3.6.15-r1 |
| alpine 3.12 | gnutls | 3.6.15-r1 |
| alpine 3.13 | gnutls | 3.7.1-r0 |
Mostrar las 58 entradas de 39 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| CBL-Mariner 1.0 | gnutls | 0:3.6.14-5.cm1 |
| CBL-Mariner 2.0 | gnutls | 0:3.6.14-5.cm2 |
| julia::Julia Ecosystem Security Advisories | GnuTLS_jll | 3.7.1+0 |
| Photon OS 1.0 | gnutls | 3.6.15-3.ph1 |
| Photon OS 2.0 | gnutls | 3.6.15-3.ph2 |
| Photon OS 3.0 | gnutls | 3.6.15-3.ph3 |
| Photon OS 4.0 | gnutls | 3.7.1-1.ph4 |
| Photon OS 4.0 | gnutls-devel | 3.7.1-1.ph4 |
| alma 8 | gnutls | 3.6.16-4.el8 |
| alma 8 | gnutls-c++ | 3.6.16-4.el8 |
| alma 8 | gnutls-dane | 3.6.16-4.el8 |
| alma 8 | gnutls-devel | 3.6.16-4.el8 |
| alma 8 | gnutls-utils | 3.6.16-4.el8 |
| alma 8 | nettle | 3.4.1-7.el8 |
| alma 8 | nettle-devel | 3.4.1-7.el8 |
| alpine 3.10 | gnutls | 3.6.15-r1 |
| alpine 3.11 | gnutls | 3.6.15-r1 |
| alpine 3.12 | gnutls | 3.6.15-r1 |
| alpine 3.13 | gnutls | 3.7.1-r0 |
| alpine 3.14 | gnutls | 3.7.1-r0 |
| alpine 3.15 | gnutls | 3.7.1-r0 |
| alpine 3.16 | gnutls | 3.7.1-r0 |
| alpine 3.17 | gnutls | 3.7.1-r0 |
| alpine 3.18 | gnutls | 3.7.1-r0 |
| alpine 3.19 | gnutls | 3.7.1-r0 |
| alpine 3.20 | gnutls | 3.7.1-r0 |
| alpine 3.21 | gnutls | 3.7.1-r0 |
| alpine 3.22 | gnutls | 3.7.1-r0 |
| alpine 3.23 | gnutls | 3.7.1-r0 |
| alpine 3.24 | gnutls | 3.7.1-r0 |
| alpine edge | gnutls | 3.7.1-r0 |
| chainguard | gnutls | 0 |
| debian 10 | gnutls28 | 3.6.7-4+deb10u7 |
| debian 11 | gnutls28 | 3.7.1-1 |
| debian 12 | gnutls28 | 3.7.1-1 |
| debian 13 | gnutls28 | 3.7.1-1 |
| debian 14 | gnutls28 | 3.7.1-1 |
| echo | gnutls28 | 3.7.1-1 |
| Oracle Linux 8 | gnutls | 3.6.16-4.el8 |
| Oracle Linux 8 | gnutls-c++ | 3.6.16-4.el8 |
| Oracle Linux 8 | gnutls-dane | 3.6.16-4.el8 |
| Oracle Linux 8 | gnutls-devel | 3.6.16-4.el8 |
| Oracle Linux 8 | gnutls-utils | 3.6.16-4.el8 |
| Oracle Linux 8 | nettle | 3.4.1-7.el8 |
| Oracle Linux 8 | nettle-devel | 3.4.1-7.el8 |
| rocky 8 | gnutls | 3.6.16-4.el8 |
| rocky 8 | gnutls-c++ | 3.6.16-4.el8 |
| rocky 8 | gnutls-dane | 3.6.16-4.el8 |
| rocky 8 | gnutls-devel | 3.6.16-4.el8 |
| rocky 8 | gnutls-utils | 3.6.16-4.el8 |
| rocky 8 | nettle | 3.4.1-7.el8 |
| rocky 8 | nettle-devel | 3.4.1-7.el8 |
| root.io alpine 3.22 | rootio-gnutls | 3.7.1-r0 |
| root.io debian 12 | rootio-gnutls28 | 3.7.1-1 |
| root.io debian 13 | rootio-gnutls28 | 3.7.1-1 |
| ubuntu 20.04 | gnutls28 | 3.6.13-2ubuntu1.6 |
| ubuntu 20.04-ESM | gnutls28 | 3.6.13-2ubuntu1.6 |
| wolfi | gnutls | 0 |
Referencias
- https://access.redhat.com/errata/RHSA-2021:4451
- https://access.redhat.com/security/cve/CVE-2021-20232
- https://bugzilla.redhat.com/1776250
- https://bugzilla.redhat.com/1908110
- https://bugzilla.redhat.com/1908334
- https://bugzilla.redhat.com/1922275
- https://bugzilla.redhat.com/1922276
- https://bugzilla.redhat.com/1965445
Las 39 referencias
- https://bugzilla.redhat.com/1967983
- https://bugzilla.redhat.com/show_bug.cgi?id=1776250
- https://bugzilla.redhat.com/show_bug.cgi?id=1908110
- https://bugzilla.redhat.com/show_bug.cgi?id=1908334
- https://bugzilla.redhat.com/show_bug.cgi?id=1922275
- https://bugzilla.redhat.com/show_bug.cgi?id=1922276
- https://bugzilla.redhat.com/show_bug.cgi?id=1965445
- https://bugzilla.redhat.com/show_bug.cgi?id=1967983
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20231
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20232
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3580
- https://errata.almalinux.org/8/ALSA-2021-4451.html
- https://errata.rockylinux.org/RLSA-2021:4451
- https://gitlab.com/gnutls/gnutls/-/issues/1151
- https://linux.oracle.com/cve/CVE-2021-20232.html
- https://linux.oracle.com/errata/ELSA-2022-9221.html
- https://lists.apache.org/thread.html/r50661d6f0082709aad9a584431b59ec364f9974b63b07e0800230168@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/r5d4001031e7790d8c6396c499522b4ed2aab782da87b1a14184793bb@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/r5f88bed447742fcc5c47bf1c7be965ef450131914a6e1f85feba2779@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/r6ac143ba6dd98bd4bf6bf010d46e56e254056459721ba18822d611f7@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/r9cbc69e57276413788e90a6ee16c7c034ea4258d31935b70db2bd158@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/rcd70a4c88a47a75fd2d5f3ffb7cee8c2a18c713320bd90fdcb57495f@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/rf5e1256d870193def4a82ad89ab95e63943a313b5ff0d81aa87e4532@%3Cissues.spark.apache.org%3E
- https://lists.apache.org/thread.html/rfd5273d72d244178441e6904a2f2b41a3268f569e8092ea0b3b2bb20@%3Cissues.spark.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OSLAE6PP33A7VYRYMYMUVB3U6B26GZER/
- https://nvd.nist.gov/vuln/detail/CVE-2021-20232
- https://security.netapp.com/advisory/ntap-20210416-0005/
- https://ubuntu.com/security/notices/USN-5029-1
- https://www.cve.org/CVERecord?id=CVE-2021-20232
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2021-03-10