CVE:CVE-2020-13777
CNNVD:CNNVD-202006-417
GnuTLS是一款免费的用于实现SSL、TLS和DTLS协议的安全通信库。
GnuTLS 3.6.14版本中存在加密问题漏洞。攻击者可通过实施中间人攻击利用该漏洞绕过TLS 1.3版本的身份验证并恢复TLS 1.2版本的先前会话。
solution:Upgrade gnu gnutls to a higher version than 3.6.14,and avoid the version [3.6.0,3.6.14); Upgrade fedoraproject fedora to a higher version than 31,32,and avoid the version 31,32; Upgrade canonical ubuntu_linux to a higher version than 19.10,20.04,and avoid the version 19.10,20.04; Upgrade debian debian_linux to a higher version than 10.0,and avoid the version 10.0