OESA-2024-1470
Record from OSV · Published April 19, 2024
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code. Security Fix(es): A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.(CVE-2024-28835)
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| gnutls | openEuler:22.03-LTS-SP1 | 3.7.2-14.oe2203sp1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| openEuler:22.03-LTS-SP1 | gnutls | 0 |
Timeline
- Apr 19, 2024 CVE Published
- Aug 18, 2026 CVE Updated
- Nov 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln OESA-2024-1470
vulnetix vdb fixes OESA-2024-1470Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/OESA-2024-1470/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart