CVE-2014-3466
gnutls: insufficient session id length check in _gnutls_read_server_hello (GNUTLS-SA-2014-3)
Severity
ImportantRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · May 30, 2014
Updated · June 27, 2026
Description
A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-130 · Improper Handling of Length Parameter Inconsistency