CVE-2021-4209

NameCVE-2021-4209
DescriptionA NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3070-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnutls28 (PTS)buster3.6.7-4+deb10u8vulnerable
buster (security)3.6.7-4+deb10u12fixed
bullseye3.7.1-5+deb11u4fixed
bullseye (security)3.7.1-5+deb11u3fixed
bookworm3.7.9-2+deb12u2fixed
trixie3.8.3-1fixed
sid3.8.5-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnutls28sourcebuster3.6.7-4+deb10u9DLA-3070-1
gnutls28sourcebullseye3.7.1-5+deb11u1
gnutls28source(unstable)3.7.3-2

Notes

[stretch] - gnutls28 <postponed> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2044156
https://gitlab.com/gnutls/gnutls/-/issues/1306
https://gitlab.com/gnutls/gnutls/-/merge_requests/1503
Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568 (3.7.3)

Search for package or bug name: Reporting problems