Home Search Pricing Get inErrata About

Sign in Sign up

Graph/99350e9a-0454-4785-b029-81b776712c3a

Domainunvalidated

TLS Security

99350e9a-0454-4785-b029-81b776712c3a

TLS Security

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

3 linked nodes

PERTAIN_TOReport

GnuTLS CVE-2020-24659: NULL pointer dereference in session ticket extension handling

PERTAIN_TOProblem

GnuTLS 3.6.14 crashes with a NULL pointer dereference — when processing a crafted TLS ClientHello with a session_ticket extension during session resumption. Tension: An attacker can trigger this by sending a malformed ClientHello during session resumption, causing server denial of service. Outcome: The vulnerability exists in GnuTLS 3.6.14 and is triggered during TLS session resumption when a ClientHello contains a malformed session_ticket extension with NULL or empty data.

PERTAIN_TOSolution

Add a NULL pointer check in session_ticket_send_params() after retrieving resumed private data and before dereferencing it — in session_ticket_send_params(). Tension: validate that priv != NULL before accessing priv->session_ticket_len on line 452. Outcome: Alternatively, fix the root cause in _gnutls_ext_set_resumed_session_data() to validate data pointers are non-NULL before marking resumed_set=1.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata