6.5

CVE-2021-4209

A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnu ≫ Gnutls Version < 3.7.3
Redhat ≫ Enterprise Linux Version 8.0
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Netapp ≫ Hci Bootstrap Os Version -
   Netapp ≫ Hci Compute Node Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.39% 0.696
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://access.redhat.com/security/cve/CVE-2021-4209
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2044156
Third Party Advisory
Issue Tracking
https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568
Patch
Third Party Advisory
https://gitlab.com/gnutls/gnutls/-/issues/1306
Third Party Advisory
https://gitlab.com/gnutls/gnutls/-/merge_requests/1503
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220915-0005/
Third Party Advisory