High severity7.4NVD Advisory· Published Apr 3, 2020· Updated Jun 17, 2026
CVE-2020-11501
CVE-2020-11501
Description
GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
41- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- GnuTLS/GnuTLSdescription
- osv-coords33 versionspkg:rpm/opensuse/gmp&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/libnettle&distro=openSUSE%20Leap%2015.1pkg:rpm/suse/gmp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP1pkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/gmp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/gmp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Certifications%2015%20SP3pkg:apk/wolfi/gnutlspkg:apk/chainguard/gnutls-devpkg:apk/chainguard/gnutls-docpkg:apk/chainguard/gnutls-c++pkg:apk/wolfi/gnutls-c++pkg:apk/chainguard/gnutlspkg:apk/wolfi/gnutls-c%2B%2Bpkg:rpm/suse/gmp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/gmp&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/gmp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/opensuse/gnutls&distro=openSUSE%20Leap%2015.1pkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:apk/chainguard/gnutls-c%2B%2Bpkg:apk/chainguard/gnutls-utilspkg:apk/wolfi/gnutls-devpkg:apk/wolfi/gnutls-docpkg:apk/wolfi/gnutls-utilspkg:rpm/suse/gmp&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/gnutls&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/libnettle&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Certifications%2015%20SP3
< 6.1.2-lp151.4.3.1+ 32 more
- (no CPE)range: < 6.1.2-lp151.4.3.1
- (no CPE)range: < 3.4.1-lp151.2.3.2
- (no CPE)range: < 6.1.2-4.3.1
- (no CPE)range: < 3.4.1-4.12.1
- (no CPE)range: < 6.1.2-4.3.1
- (no CPE)range: < 3.6.7-6.14.1
- (no CPE)range: < 3.4.1-4.12.1
- (no CPE)range: < 3.4.1-4.12.1
- (no CPE)range: < 6.1.2-4.3.1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 6.1.2-4.3.1
- (no CPE)range: < 3.6.7-6.14.1
- (no CPE)range: < 6.1.2-4.3.1
- (no CPE)range: < 3.6.7-6.14.1
- (no CPE)range: < 6.1.2-4.3.1
- (no CPE)range: < 3.6.7-lp151.2.6.1
- (no CPE)range: < 3.6.7-6.14.1
- (no CPE)range: < 3.4.1-4.12.1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 6.1.2-4.3.1
- (no CPE)range: < 3.6.7-6.14.1
- (no CPE)range: < 3.4.1-4.12.1
- (no CPE)range: < 3.4.1-4.12.1
- Range: <3.6.13
Patches
Vulnerability mechanics
References
10- gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2nvdPatchThird Party Advisory
- gitlab.com/gnutls/gnutls/-/issues/960nvdIssue TrackingPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.htmlnvdThird Party Advisory
- security.gentoo.org/glsa/202004-06nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20200416-0002/nvdThird Party Advisory
- usn.ubuntu.com/4322-1/nvdThird Party Advisory
- www.debian.org/security/2020/dsa-4652nvdThird Party Advisory
- www.gnutls.org/security-new.htmlnvdVendor Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/nvd
News mentions
0No linked articles in our index yet.