9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.285 Low
EPSS
Percentile
96.8%
CentOS Errata and Security Advisory CESA-2017:2292
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.
The following packages have been upgraded to a later upstream version: gnutls (3.3.26). (BZ#1378373)
Security Fix(es):
A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially-crafted certificate which, when processed by an application compiled against GnuTLS, could cause that application to crash. (CVE-2017-5334)
Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337, CVE-2017-7869)
A null pointer dereference flaw was found in the way GnuTLS processed ClientHello messages with status_request extension. A remote attacker could use this flaw to cause an application compiled with GnuTLS to crash. (CVE-2017-7507)
A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances. (CVE-2016-7444)
The CVE-2017-7507 issue was discovered by Hubert Kario (Red Hat QE BaseOS Security team).
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2017-August/030448.html
Affected packages:
gnutls
gnutls-c++
gnutls-dane
gnutls-devel
gnutls-utils
Upstream details at:
https://access.redhat.com/errata/RHSA-2017:2292
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 7 | i686 | gnutls | < 3.3.26-9.el7 | gnutls-3.3.26-9.el7.i686.rpm |
CentOS | 7 | x86_64 | gnutls | < 3.3.26-9.el7 | gnutls-3.3.26-9.el7.x86_64.rpm |
CentOS | 7 | i686 | gnutls-c++ | < 3.3.26-9.el7 | gnutls-c++-3.3.26-9.el7.i686.rpm |
CentOS | 7 | x86_64 | gnutls-c++ | < 3.3.26-9.el7 | gnutls-c++-3.3.26-9.el7.x86_64.rpm |
CentOS | 7 | i686 | gnutls-dane | < 3.3.26-9.el7 | gnutls-dane-3.3.26-9.el7.i686.rpm |
CentOS | 7 | x86_64 | gnutls-dane | < 3.3.26-9.el7 | gnutls-dane-3.3.26-9.el7.x86_64.rpm |
CentOS | 7 | i686 | gnutls-devel | < 3.3.26-9.el7 | gnutls-devel-3.3.26-9.el7.i686.rpm |
CentOS | 7 | x86_64 | gnutls-devel | < 3.3.26-9.el7 | gnutls-devel-3.3.26-9.el7.x86_64.rpm |
CentOS | 7 | x86_64 | gnutls-utils | < 3.3.26-9.el7 | gnutls-utils-3.3.26-9.el7.x86_64.rpm |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.285 Low
EPSS
Percentile
96.8%