CVE-2021-4209: Null Pointer Dereference
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.
Other sources
Using gnutls with guile disabled, null pointer may passed to memcpy as argument 2, causing null pointer dereference.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-4209?
CVE-2021-4209 is a NULL pointer dereference flaw in GnuTLS that can cause a denial of service after authentication in rare circumstances.
How does CVE-2021-4209 affect GnuTLS?
CVE-2021-4209 affects GnuTLS versions up to and excluding 3.7.3, leading to a denial of service vulnerability.
What is the severity of CVE-2021-4209?
CVE-2021-4209 has a severity rating of 6.5 (medium).
Which software versions are affected by CVE-2021-4209?
GnuTLS versions up to and excluding 3.7.3 are affected by CVE-2021-4209.
How can I fix CVE-2021-4209?
To fix CVE-2021-4209, it is recommended to update GnuTLS to version 3.7.3 or higher.