[SECURITY] [DLA 3070-1] gnutls28 security update

2022-08-1110:53:57

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.1%

JSON

Debian LTS Advisory DLA-3070-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
August 11, 2022 https://wiki.debian.org/LTS

Package : gnutls28
Version : 3.6.7-4+deb10u9
CVE ID : CVE-2021-4209 CVE-2022-2509

Two issues were found in GnuTLS, a library implementing the TLS and SSL
protocols. A remote attacker could take advantage of these flaws to
cause an application using the GnuTLS library to crash (denial of
service), or potentially, to execute arbitrary code.

For Debian 10 buster, these problems have been fixed in version
3.6.7-4+deb10u9.

We recommend that you upgrade your gnutls28 packages.

For the detailed security status of gnutls28 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gnutls28

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11mips64ellibgnutls30-dbgsym< 3.7.1-5+deb11u2libgnutls30-dbgsym_3.7.1-5+deb11u2_mips64el.deb
Debian11s390xguile-gnutls-dbgsym< 3.7.1-5+deb11u2guile-gnutls-dbgsym_3.7.1-5+deb11u2_s390x.deb
Debian11ppc64elguile-gnutls-dbgsym< 3.7.1-5+deb11u2guile-gnutls-dbgsym_3.7.1-5+deb11u2_ppc64el.deb
Debian11s390xguile-gnutls< 3.7.1-5+deb11u2guile-gnutls_3.7.1-5+deb11u2_s390x.deb
Debian11armhflibgnutlsxx28-dbgsym< 3.7.1-5+deb11u2libgnutlsxx28-dbgsym_3.7.1-5+deb11u2_armhf.deb
Debian11s390xgnutls-bin< 3.7.1-5+deb11u2gnutls-bin_3.7.1-5+deb11u2_s390x.deb
Debian11armhflibgnutls-dane0< 3.7.1-5+deb11u2libgnutls-dane0_3.7.1-5+deb11u2_armhf.deb
Debian11i386libgnutls28-dev< 3.7.1-5+deb11u2libgnutls28-dev_3.7.1-5+deb11u2_i386.deb
Debian11ppc64ellibgnutls30< 3.7.1-5+deb11u2libgnutls30_3.7.1-5+deb11u2_ppc64el.deb
Debian11mips64ellibgnutlsxx28< 3.7.1-5+deb11u2libgnutlsxx28_3.7.1-5+deb11u2_mips64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	mips64el	libgnutls30-dbgsym	< 3.7.1-5+deb11u2	libgnutls30-dbgsym_3.7.1-5+deb11u2_mips64el.deb
Debian	11	s390x	guile-gnutls-dbgsym	< 3.7.1-5+deb11u2	guile-gnutls-dbgsym_3.7.1-5+deb11u2_s390x.deb
Debian	11	ppc64el	guile-gnutls-dbgsym	< 3.7.1-5+deb11u2	guile-gnutls-dbgsym_3.7.1-5+deb11u2_ppc64el.deb
Debian	11	s390x	guile-gnutls	< 3.7.1-5+deb11u2	guile-gnutls_3.7.1-5+deb11u2_s390x.deb
Debian	11	armhf	libgnutlsxx28-dbgsym	< 3.7.1-5+deb11u2	libgnutlsxx28-dbgsym_3.7.1-5+deb11u2_armhf.deb
Debian	11	s390x	gnutls-bin	< 3.7.1-5+deb11u2	gnutls-bin_3.7.1-5+deb11u2_s390x.deb
Debian	11	armhf	libgnutls-dane0	< 3.7.1-5+deb11u2	libgnutls-dane0_3.7.1-5+deb11u2_armhf.deb
Debian	11	i386	libgnutls28-dev	< 3.7.1-5+deb11u2	libgnutls28-dev_3.7.1-5+deb11u2_i386.deb
Debian	11	ppc64el	libgnutls30	< 3.7.1-5+deb11u2	libgnutls30_3.7.1-5+deb11u2_ppc64el.deb
Debian	11	mips64el	libgnutlsxx28	< 3.7.1-5+deb11u2	libgnutlsxx28_3.7.1-5+deb11u2_mips64el.deb