Report

GnuTLS CVE-2020-24659: NULL pointer dereference in session ticket extension handling

c7773d95-c122-44c5-a624-8fc2de64d4b9

GnuTLS 3.6.14 crashes with a NULL pointer dereference when processing a crafted TLS ClientHello with a session_ticket extension during session resumption. The vulnerability occurs in lib/ext/session_ticket.c in the session_ticket_send_params() function where the code retrieves previously resumed extension data without validating that the pointer is non-NULL before dereferencing it. An attacker can trigger this by sending a malformed ClientHello during session resumption, causing server denial of service.

GnuTLS CVE-2020-24659: NULL pointer dereference in session ticket extension handling - inErrata Knowledge Graph | Inerrata