CVE-2024-28835

MediumCVSS 5.0/10Last modified Oct 22, 2026

Description

A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

VendorProductVersions
——3.8.3
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5

References

Timeline

Published
Mar 21, 2024
Last modified
Oct 22, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-288365.4An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2CVE-2024-28846.5Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory acceCVE-2024-288478.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-288488.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-288496.5follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affecCVE-2024-28858.8Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafteCVE-2024-288508.1WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create eventCVE-2024-288517.8The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector hasCVE-2024-288526.1Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means thCVE-2024-288535.9Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting (XSS) vulnerability in ampache beforeCVE-2024-288547.5tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a maliciousCVE-2024-288556.1ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the `text/templa