CVE-2020-11501

Name of the Vulnerable Software and Affected Versions GnuTLS versions 3.6.3 through 3.6.12

Description The issue is related to the send client hello function in the GnuTLS cryptographic library, which has shortcomings in the used cryptographic algorithms. This can allow a remote attacker to gain unauthorized access to confidential data or impact data integrity. The problem arises because the DTLS client always uses 32 '0' bytes instead of a random value, contributing no randomness to a DTLS negotiation, thus breaking the security guarantees of the DTLS protocol.

Recommendations For GnuTLS versions 3.6.3 through 3.6.12, update to version 3.6.13 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DTLS protocol until a patch is available. Avoid using the DTLS client with the affected versions of GnuTLS to minimize the risk of exploitation.