CVE-2019-3829

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

• CWE-416
• CWE-415
• CWE-416

• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html
• https://access.redhat.com/errata/RHSA-2019:3600
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3829Issue Tracking, Third Party Advisory
• https://gitlab.com/gnutls/gnutls/issues/694Exploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGXVMBGVXKUAN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7TJIBRJWGWSH6XIO2MXIQ3W6ES4R6I4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRSOL66LHP4SD3Y2ECJDOGT4K663ECDU/
• https://security.gentoo.org/glsa/201904-14
• https://security.netapp.com/advisory/ntap-20190619-0004/
• https://usn.ubuntu.com/3999-1/
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27Exploit, Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html
• https://access.redhat.com/errata/RHSA-2019:3600
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3829Issue Tracking, Third Party Advisory
• https://gitlab.com/gnutls/gnutls/issues/694Exploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3ETBUFBB4G7AITAOUYPGXVMBGVXKUAN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7TJIBRJWGWSH6XIO2MXIQ3W6ES4R6I4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WRSOL66LHP4SD3Y2ECJDOGT4K663ECDU/
• https://security.gentoo.org/glsa/201904-14
• https://security.netapp.com/advisory/ntap-20190619-0004/
• https://usn.ubuntu.com/3999-1/
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2019-03-27Exploit, Patch, Vendor Advisory

Published

Mar 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3823libcurl versions from 7.34.0 to before 7.64.0 are vulnerable…4.3
• CVE-2019-3824A flaw was found in the way an LDAP search expression could …
• CVE-2019-3825A vulnerability was discovered in gdm before 3.31.4. When ti…6.3
• CVE-2019-3826A stored, DOM based, cross-site scripting (XSS) flaw was fou…6.1
• CVE-2019-3827An incorrect permission check in the admin backend in gvfs b…7
• CVE-2019-3828Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 h…4.2
• CVE-2019-3830A vulnerability was found in ceilometer before version 12.0.…7.8
• CVE-2019-3831A vulnerability was discovered in vdsm, version 4.19 through…6.7
• CVE-2019-3832It was discovered the fix for CVE-2018-19758 (libsndfile) wa…5.5
• CVE-2019-3833Openwsman, versions up to and including 2.6.9, are vulnerabl…7.5
• CVE-2019-3834It was found that the fix for CVE-2014-0114 had been reverte…7.3
• CVE-2019-3835It was found that the superexec operator was available in th…5.5