CVE-2024-0567 is a high severity certificate validation dos flaw in GnuTLS, scored CVSS 7.5. The record lists GnuTLS, with Fedora 38 and 39 and NetApp Active IQ Unified Manager among configurations. Apply the distribution update. The sections below cover how to check and what to do first.
What's affected
The record lists GnuTLS, with Fedora 38 and 39 and NetApp Active IQ Unified Manager among configurations. The trigger is cockpit rejecting a certificate chain with distributed trust during cockpit-certificate-ensure.
An unauthenticated remote client can cause a denial of service.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with a base score of 7.5 (High). KEV status: not listed in the record.
Fixed version: Apply the distribution update. Red Hat errata including RHSA-2024:0533 are in the record references. Check your vendor for the exact package build.
How to check if you're exposed
Check the installed package build and the distribution advisory.
gnutls-cli --version
rpm -q gnutls cockpit
# Debian or Ubuntu
dpkg -l | grep -E 'gnutls|cockpit'
Compare the result with the errata for your distribution. For application images, run a free in-browser dependency scan to see whether a vulnerable GnuTLS is bundled.
What to do now
- Update GnuTLS and cockpit packages using your distribution advisory.
- Restart services that link GnuTLS so the new library loads.
- Rescan images and hosts to confirm the vulnerable build is gone.
Why it matters
CWE-347 describes this class. Improper verification of a cryptographic signature means a check that should decide whether a certificate chain is trustworthy gives the wrong answer for some inputs. Here the failure mode is a valid style of chain being rejected. Rejecting good input is a safety failure of its own, because a service that cannot validate its peers can be knocked out by traffic that should have been accepted.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-16.
For a wider view, a free in-browser dependency scan and the Gold directory show where GnuTLS sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0567 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Is restarting services required after the update?
Yes. Running processes keep the old library in memory until they restart.
Sources
- Safeguard Gold entry for CVE-2024-0567
- NVD record data for CVE-2024-0567, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
