7.4

CVE-2020-11501: canonical ubuntu_linux Use of Insufficiently Random Values

CVSS: 7.4v3.1HighModified
AliasesALPINE-CVE-2020-11501MGASA-2020-0168SUSE-SU-2020:0948-1
Published 03-04-2020Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2020-11501 is a high (CVSS 7.4) Use of Insufficiently Random Values vulnerability in canonical ubuntu_linux. EPSS estimates a 3.39% chance of exploitation in the next 30 days, higher than 88.6% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v3.1 (NVD)
EPSS score
3.39%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-4FFP-6G99-3QCHCGA-GGFX-FC6J-7VJ9

Timeline

  1. 03-04-2020
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.

CVSS metrics

8 scores · 7 sources · 2 versions

EPSS trend

Probability

3.39%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

0.00 pp

From 3.39% on 19-09-2026

19-09-202619-10-2026
EPSS score
3.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse18 products
  • gmp&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 6.1.2-4.3.1
  • gmp&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 6.1.2-4.3.1
  • gmp&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 6.1.2-4.3.1
  • gmp&distro=SUSE Linux Enterprise Module for Certifications 15 SP3< 6.1.2-4.3.1
  • gmp&distro=SUSE Linux Enterprise Module for Development Tools 15 SP1< 6.1.2-4.3.1
Redhat10 products
  • gnutls< 0:3.6.8-10.el8_2
  • gnutls-c++< 0:3.6.8-10.el8_2
  • gnutls-c++-debuginfo< 0:3.6.8-10.el8_2
  • gnutls-dane< 0:3.6.8-10.el8_2
  • gnutls-dane-debuginfo< 0:3.6.8-10.el8_2
Opensuse4 products
  • leapEOL15.1
  • gmp&distro=openSUSE Leap 15.1< 6.1.2-lp151.4.3.1
  • gnutls&distro=openSUSE Leap 15.1< 3.6.7-lp151.2.6.1
  • libnettle&distro=openSUSE Leap 15.1< 3.4.1-lp151.2.3.2
Debian2 products
Alpine1 product
  • gnutls≥ 3.6.3, < 3.6.8-r1 | ≥ 3.6.3, < 3.6.13-r0 | ≥ 3.6.3, < 3.6.7-r1
Canonical1 product
Chainguard1 product
  • gnutlsAll versions (No fix recorded)
Fedoraproject1 product
Gnu1 product
Mageia1 product
  • gnutls< 3.6.7-1.1.mga7
Ubuntu1 product
  • gnutls28< 3.4.10-4ubuntu1.7 | < 3.5.18-1ubuntu1.3
Wolfi1 product
  • gnutlsAll versions (No fix recorded)

12 vendors · 42 products

References

33 links
Show all 33 references