CVE-2024-0567 Gnutls: rejects certificate chain with distributed trust
An unauthenticated remote attacker can cause a denial of service in applications using GnuTLS by submitting a certificate chain with distributed trust.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-0567?
CVE-2024-0567 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 16 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.
Weakness: CWE-347
Which versions are affected by CVE-2024-0567?
It affects 4 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Gnu Gnutls, Netapp Active Iq Unified Manager.
How do I fix CVE-2024-0567?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-0567 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-0567 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2024-0567, AZL-33340, AZL-34740, BELL-CVE-2024-0567, CLSA-2024-1708029936, CLSA-2025-1744390816 and 4 more.