ID FEDORA_2013-2110.NASL Type nessus Reporter Tenable Modified 2015-10-19T00:00:00
Description
Update to 2.12.22.
Applied patches for CVE-2013-1619.
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory 2013-2110.
#
include("compat.inc");
if (description)
{
script_id(64651);
script_version("$Revision: 1.8 $");
script_cvs_date("$Date: 2015/10/19 21:37:39 $");
script_cve_id("CVE-2013-1619");
script_bugtraq_id(57736);
script_xref(name:"FEDORA", value:"2013-2110");
script_name(english:"Fedora 18 : mingw-gnutls-2.12.22-1.fc18 (2013-2110)");
script_summary(english:"Checks rpm output for the updated package.");
script_set_attribute(
attribute:"synopsis",
value:"The remote Fedora host is missing a security update."
);
script_set_attribute(
attribute:"description",
value:
" - Update to 2.12.22.
- Applied patches for CVE-2013-1619.
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.redhat.com/show_bug.cgi?id=908238"
);
# https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098837.html
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?83207cc1"
);
script_set_attribute(
attribute:"solution",
value:"Update the affected mingw-gnutls package."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N");
script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mingw-gnutls");
script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:18");
script_set_attribute(attribute:"patch_publication_date", value:"2013/02/08");
script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/18");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2013-2015 Tenable Network Security, Inc.");
script_family(english:"Fedora Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^18([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 18.x", "Fedora " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
flag = 0;
if (rpm_check(release:"FC18", reference:"mingw-gnutls-2.12.22-1.fc18")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
else security_warning(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mingw-gnutls");
}
{"published": "2013-02-18T00:00:00", "id": "FEDORA_2013-2110.NASL", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "history": [{"differentElements": ["cpe"], "edition": 1, "lastseen": "2016-09-26T17:23:03", "bulletin": {"enchantments": {}, "published": "2013-02-18T00:00:00", "id": "FEDORA_2013-2110.NASL", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "history": [], "cpe": [], "hash": "366f1d656476459a9b93e0b583a1dd85a4d4af416b0190e62bd5f219959aba74", "description": "- Update to 2.12.22.\n\n - Applied patches for CVE-2013-1619.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "type": "nessus", "pluginID": "64651", "lastseen": "2016-09-26T17:23:03", "edition": 1, "title": "Fedora 18 : mingw-gnutls-2.12.22-1.fc18 (2013-2110)", "href": "https://www.tenable.com/plugins/index.php?view=single&id=64651", "modified": "2015-10-19T00:00:00", "bulletinFamily": "scanner", "viewCount": 0, "cvelist": ["CVE-2013-1619"], "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=908238", "http://www.nessus.org/u?83207cc1"], "naslFamily": "Fedora Local Security Checks", "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-2110.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(64651);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2015/10/19 21:37:39 $\");\n\n script_cve_id(\"CVE-2013-1619\");\n script_bugtraq_id(57736);\n script_xref(name:\"FEDORA\", value:\"2013-2110\");\n\n script_name(english:\"Fedora 18 : mingw-gnutls-2.12.22-1.fc18 (2013-2110)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 2.12.22.\n\n - Applied patches for CVE-2013-1619.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=908238\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098837.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?83207cc1\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mingw-gnutls package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mingw-gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:18\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^18([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 18.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC18\", reference:\"mingw-gnutls-2.12.22-1.fc18\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mingw-gnutls\");\n}\n", "hashmap": [{"hash": "0b722b3d37e86728356f0204df47727d", "key": "description"}, {"hash": "5a1d923d1a6dbcf1d1e11d9657878b6c", "key": "cvelist"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "6fa2f8b9223e2a26c310474ee2569a9e", "key": "sourceData"}, {"hash": "ad98cd15155e3fcb9004f91f3a5befd6", "key": "href"}, {"hash": "9a00910eeedb8c835c4637a953896665", "key": "modified"}, {"hash": "e24b912330e8186d2c202921054d2f9d", "key": "title"}, {"hash": "9934e02f2dcbc6b05a648d23b727456e", "key": "references"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "452cd45cff271fe9a314af79f9c946cd", "key": "published"}, {"hash": "be931514784f88df80712740ad2723e7", "key": "naslFamily"}, {"hash": "1f72477ff44f4d633d1a66eb1da0027b", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "b82bdc1879e285e3d80370cdfcd4bd60", "key": "pluginID"}], "objectVersion": "1.2"}}], "description": "- Update to 2.12.22.\n\n - Applied patches for CVE-2013-1619.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "hash": "04e735e51115f6a5ca88d8bd8ffe3568c2c46ba32b3dee4279bf992a48f981c3", "enchantments": {"vulnersScore": 2.1}, "type": "nessus", "pluginID": "64651", "lastseen": "2017-10-29T13:33:00", "edition": 2, "cpe": ["cpe:/o:fedoraproject:fedora:18", "p-cpe:/a:fedoraproject:fedora:mingw-gnutls"], "title": "Fedora 18 : mingw-gnutls-2.12.22-1.fc18 (2013-2110)", "href": "https://www.tenable.com/plugins/index.php?view=single&id=64651", "modified": "2015-10-19T00:00:00", "bulletinFamily": "scanner", "viewCount": 0, "cvelist": ["CVE-2013-1619"], "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=908238", "http://www.nessus.org/u?83207cc1"], "naslFamily": "Fedora Local Security Checks", "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-2110.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(64651);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2015/10/19 21:37:39 $\");\n\n script_cve_id(\"CVE-2013-1619\");\n script_bugtraq_id(57736);\n script_xref(name:\"FEDORA\", value:\"2013-2110\");\n\n script_name(english:\"Fedora 18 : mingw-gnutls-2.12.22-1.fc18 (2013-2110)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 2.12.22.\n\n - Applied patches for CVE-2013-1619.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=908238\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-February/098837.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?83207cc1\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected mingw-gnutls package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:mingw-gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:18\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/02/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/02/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^18([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 18.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC18\", reference:\"mingw-gnutls-2.12.22-1.fc18\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mingw-gnutls\");\n}\n", "hashmap": [{"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "fdceede9f9de217f4b024c7319d4674b", "key": "cpe"}, {"hash": "5a1d923d1a6dbcf1d1e11d9657878b6c", "key": "cvelist"}, {"hash": "1f72477ff44f4d633d1a66eb1da0027b", "key": "cvss"}, {"hash": "0b722b3d37e86728356f0204df47727d", "key": "description"}, {"hash": "ad98cd15155e3fcb9004f91f3a5befd6", "key": "href"}, {"hash": "9a00910eeedb8c835c4637a953896665", "key": "modified"}, {"hash": "be931514784f88df80712740ad2723e7", "key": "naslFamily"}, {"hash": "b82bdc1879e285e3d80370cdfcd4bd60", "key": "pluginID"}, {"hash": "452cd45cff271fe9a314af79f9c946cd", "key": "published"}, {"hash": "9934e02f2dcbc6b05a648d23b727456e", "key": "references"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "6fa2f8b9223e2a26c310474ee2569a9e", "key": "sourceData"}, {"hash": "e24b912330e8186d2c202921054d2f9d", "key": "title"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}], "objectVersion": "1.3"}
{"result": {"cve": [{"id": "CVE-2013-1619", "type": "cve", "title": "CVE-2013-1619", "description": "The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.", "published": "2013-02-08T14:55:01", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1619", "cvelist": ["CVE-2013-1619"], "lastseen": "2016-09-03T18:11:45"}], "f5": [{"id": "SOL15721", "type": "f5", "title": "SOL15721 - GnuTLS vulnerability CVE-2013-1619", "description": "Recommended Action\n\nNone\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n", "published": "2014-10-23T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://support.f5.com/kb/en-us/solutions/public/15000/700/sol15721.html", "cvelist": ["CVE-2013-0169", "CVE-2013-1619"], "lastseen": "2016-11-09T00:10:02"}], "openvas": [{"id": "OPENVAS:870945", "type": "openvas", "title": "RedHat Update for gnutls RHSA-2013:0588-01", "description": "Check for the Version of gnutls", "published": "2013-03-05T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=870945", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-07-27T10:51:19"}, {"id": "OPENVAS:865362", "type": "openvas", "title": "Fedora Update for mingw-gnutls FEDORA-2013-2110", "description": "Check for the Version of mingw-gnutls", "published": "2013-02-18T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=865362", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-07-25T10:51:39"}, {"id": "OPENVAS:865462", "type": "openvas", "title": "Fedora Update for libtasn1 FEDORA-2013-2984", "description": "Check for the Version of libtasn1", "published": "2013-03-15T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=865462", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-01-24T11:09:31"}, {"id": "OPENVAS:1361412562310881624", "type": "openvas", "title": "CentOS Update for gnutls CESA-2013:0588 centos5 ", "description": "Check for the Version of gnutls", "published": "2013-03-08T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310881624", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-04-06T11:23:57"}, {"id": "OPENVAS:1361412562310865360", "type": "openvas", "title": "Fedora Update for mingw-gnutls FEDORA-2013-2128", "description": "Check for the Version of mingw-gnutls", "published": "2013-02-18T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310865360", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-04-06T11:22:27"}, {"id": "OPENVAS:865466", "type": "openvas", "title": "Fedora Update for mingw-gnutls FEDORA-2013-3438", "description": "Check for the Version of mingw-gnutls", "published": "2013-03-15T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=865466", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-02-05T11:11:34"}, {"id": "OPENVAS:1361412562310870945", "type": "openvas", "title": "RedHat Update for gnutls RHSA-2013:0588-01", "description": "Check for the Version of gnutls", "published": "2013-03-05T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310870945", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-04-09T11:22:06"}, {"id": "OPENVAS:1361412562310123685", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2013-0588", "description": "Oracle Linux Local Security Checks ELSA-2013-0588", "published": "2015-10-06T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123685", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-07-24T12:52:43"}, {"id": "OPENVAS:1361412562310865462", "type": "openvas", "title": "Fedora Update for libtasn1 FEDORA-2013-2984", "description": "Check for the Version of libtasn1", "published": "2013-03-15T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310865462", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-04-06T11:21:30"}, {"id": "OPENVAS:1361412562310865437", "type": "openvas", "title": "Fedora Update for gnutls FEDORA-2013-2892", "description": "Check for the Version of gnutls", "published": "2013-03-08T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310865437", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-04-06T11:22:50"}], "nessus": [{"id": "SL_20130304_GNUTLS_ON_SL5_X.NASL", "type": "nessus", "title": "Scientific Linux Security Update : gnutls on SL5.x, SL6.x i386/x86_64", "description": "It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619)\n\nFor the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.", "published": "2013-03-05T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=65019", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:40:04"}, {"id": "FEDORA_2013-2984.NASL", "type": "nessus", "title": "Fedora 17 : gnutls-2.12.23-1.fc17 / libtasn1-2.14-1.fc17 (2013-2984)", "description": "Minor security and bugfix update from upstream.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-03-13T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=65234", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:40:07"}, {"id": "CENTOS_RHSA-2013-0588.NASL", "type": "nessus", "title": "CentOS 5 / 6 : gnutls (CESA-2013:0588)", "description": "Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nThe GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).\n\nIt was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619)\n\nUsers of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.", "published": "2013-03-06T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=65032", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:41:22"}, {"id": "ALA_ALAS-2013-172.NASL", "type": "nessus", "title": "Amazon Linux AMI : gnutls (ALAS-2013-172)", "description": "It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619)", "published": "2013-09-04T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=69731", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-04-19T07:25:44"}, {"id": "FEDORA_2013-2892.NASL", "type": "nessus", "title": "Fedora 18 : gnutls-2.12.23-1.fc18 (2013-2892)", "description": "Minor security and bugfix update from upstream.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-03-06T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=65036", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:41:39"}, {"id": "REDHAT-RHSA-2013-0588.NASL", "type": "nessus", "title": "RHEL 5 / 6 : gnutls (RHSA-2013:0588)", "description": "Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nThe GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).\n\nIt was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619)\n\nUsers of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.", "published": "2013-03-05T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=65005", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:41:38"}, {"id": "FEDORA_2013-2128.NASL", "type": "nessus", "title": "Fedora 17 : mingw-gnutls-2.12.20-1.fc17 (2013-2128)", "description": "- Update to 2.12.20.\n\n - Apply patches for CVE-2013-1619.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-02-18T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=64664", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:34:13"}, {"id": "SLACKWARE_SSA_2013-242-03.NASL", "type": "nessus", "title": "Slackware 14.0 / current : gnutls (SSA:2013-242-03)", "description": "New gnutls packages are available for Slackware 14.0 and -current to fix a security issue. Sorry about having to reissue this one -- I pulled it from ftp.gnu.org not realizing that the latest version there was actually months out of date.", "published": "2013-09-02T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=69521", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:41:16"}, {"id": "ORACLELINUX_ELSA-2013-0588.NASL", "type": "nessus", "title": "Oracle Linux 5 / 6 : gnutls (ELSA-2013-0588)", "description": "From Red Hat Security Advisory 2013:0588 :\n\nUpdated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.\n\nThe GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).\n\nIt was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619)\n\nUsers of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted, or the system rebooted.", "published": "2013-07-12T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=68769", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:37:53"}, {"id": "MANDRIVA_MDVSA-2013-040.NASL", "type": "nessus", "title": "Mandriva Linux Security Advisory : gnutls (MDVSA-2013:040)", "description": "Nadhem Alfardan and Kenny Paterson devised an attack that recovers some bits of the plaintext of a GnuTLS session that utilizes that CBC ciphersuites, by using timing information (CVE-2013-1619).\n\nThe gnutls package has been updated to latest 3.0.28 version to fix above problem.", "published": "2013-04-20T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=66054", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-10-29T13:43:17"}], "ubuntu": [{"id": "USN-1752-1", "type": "ubuntu", "title": "GnuTLS vulnerability", "description": "Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in GnuTLS was vulnerable to a timing side-channel attack known as the \u201cLucky Thirteen\u201d issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data.", "published": "2013-02-27T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://usn.ubuntu.com/1752-1/", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-03-29T18:17:38"}], "slackware": [{"id": "SSA-2013-242-01", "type": "slackware", "title": "gnutls", "description": "New gnutls packages are available for Slackware 14.0, and -current to fix a\nsecurity issue.\n\n\nHere are the details from the Slackware 14.0 ChangeLog:\n\npatches/packages/gnutls-3.0.26-i486-1_slack14.0.txz: Upgraded.\n This update prevents a side-channel attack which may allow remote attackers\n to conduct distinguishing attacks and plaintext recovery attacks using\n statistical analysis of timing data for crafted packets.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the "Get Slack" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/gnutls-3.0.26-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/gnutls-3.0.26-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/gnutls-3.0.26-i486-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/gnutls-3.0.26-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.0 package:\nb4871658060b56ee03e2d04a9d5b96e4 gnutls-3.0.26-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n976ca3bf65238d75a027cb2203cf9612 gnutls-3.0.26-x86_64-1_slack14.0.txz\n\nSlackware -current package:\n16e99934d07c8aab09016e0cb2c6cfa1 n/gnutls-3.0.26-i486-1.txz\n\nSlackware x86_64 -current package:\ndffa995fb8369f1c7afd7342dd31697e n/gnutls-3.0.26-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg gnutls-3.0.26-i486-1_slack14.0.txz", "published": "2013-08-30T00:46:14", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.354993", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-02-02T18:11:30"}, {"id": "SSA-2013-242-03", "type": "slackware", "title": "gnutls", "description": "New gnutls packages are available for Slackware 14.0 and -current to fix a\nsecurity issue.\n\nSorry about having to reissue this one -- I pulled it from ftp.gnu.org not\nrealizing that the latest version there was actually months out of date.\n\n\nHere are the details from the Slackware 14.0 ChangeLog:\n\npatches/packages/gnutls-3.0.31-i486-1_slack14.0.txz: Upgraded.\n [Updated to the correct version to fix fetching the "latest" from gnu.org]\n This update prevents a side-channel attack which may allow remote attackers\n to conduct distinguishing attacks and plaintext recovery attacks using\n statistical analysis of timing data for crafted packets.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the "Get Slack" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/gnutls-3.0.31-i486-1_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/gnutls-3.0.31-x86_64-1_slack14.0.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/gnutls-3.0.31-i486-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/gnutls-3.0.31-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.0 package:\ndeffffdf6b2a432a11fde60237892407 gnutls-3.0.31-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n7c035da64b6f6b981b9479a49944257f gnutls-3.0.31-x86_64-1_slack14.0.txz\n\nSlackware -current package:\n66c5b3d438a7833f5ff1266c2f11a816 n/gnutls-3.0.31-i486-1.txz\n\nSlackware x86_64 -current package:\nf09cf7bd0ab4f89212ab10aaef495fa1 n/gnutls-3.0.31-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg gnutls-3.0.31-i486-1_slack14.0.txz", "published": "2013-08-30T13:25:45", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.374026", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-02-02T18:11:39"}, {"id": "SSA-2013-287-03", "type": "slackware", "title": "gnutls", "description": "New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1,\nand 13.37 to fix security issues.\n\n\nHere are the details from the Slackware 13.37 ChangeLog:\n\npatches/packages/gnutls-2.10.5-i486-2_slack13.37.txz: Rebuilt.\n [Updated to the correct version to fix fetching the "latest" from gnu.org]\n This update prevents a side-channel attack which may allow remote attackers\n to conduct distinguishing attacks and plaintext recovery attacks using\n statistical analysis of timing data for crafted packets.\n Other minor security issues are patched as well.\n Thanks to mancha for backporting these patches.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4128\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1569\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2116\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the "Get Slack" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 12.1:\nftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/gnutls-2.8.4-i486-2_slack12.1.tgz\n\nUpdated package for Slackware 12.2:\nftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/gnutls-2.8.4-i486-2_slack12.2.tgz\n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/gnutls-2.8.4-i486-2_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/gnutls-2.8.4-x86_64-2_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/gnutls-2.8.6-i486-2_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/gnutls-2.8.6-x86_64-2_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/gnutls-2.10.5-i486-2_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/gnutls-2.10.5-x86_64-2_slack13.37.txz\n\n\nMD5 signatures:\n\nSlackware 12.1 package:\nb1befa86737a2451146dd108eb58b9a9 gnutls-2.8.4-i486-2_slack12.1.tgz\n\nSlackware 12.2 package:\n7ea0f267149d76ccdcca1206027e664f gnutls-2.8.4-i486-2_slack12.2.tgz\n\nSlackware 13.0 package:\n2c102969a15b8a66e79ec4d07821faf7 gnutls-2.8.4-i486-2_slack13.0.txz\n\nSlackware x86_64 13.0 package:\n501b5709da4ff494a3ecdfee74187281 gnutls-2.8.4-x86_64-2_slack13.0.txz\n\nSlackware 13.1 package:\na7d101cd7fc47cf9e4e0f15406ca29fd gnutls-2.8.6-i486-2_slack13.1.txz\n\nSlackware x86_64 13.1 package:\n65a234fe93b46c7ea29799ffc3e4f25e gnutls-2.8.6-x86_64-2_slack13.1.txz\n\nSlackware 13.37 package:\n9cf8770560e17d1d57267cb05bf3badd gnutls-2.10.5-i486-2_slack13.37.txz\n\nSlackware x86_64 13.37 package:\n349f7f77e29612b679522a4a199c03fa gnutls-2.10.5-x86_64-2_slack13.37.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg gnutls-2.10.5-i486-2_slack13.37.txz", "published": "2013-10-14T17:18:30", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.467196", "cvelist": ["CVE-2011-4128", "CVE-2013-1619", "CVE-2012-1569", "CVE-2012-1573", "CVE-2013-2116"], "lastseen": "2018-02-02T18:11:33"}], "centos": [{"id": "CESA-2013:0588", "type": "centos", "title": "gnutls security update", "description": "**CentOS Errata and Security Advisory** CESA-2013:0588\n\n\nThe GnuTLS library provides support for cryptographic algorithms and for\nprotocols such as Transport Layer Security (TLS).\n\nIt was discovered that GnuTLS leaked timing information when decrypting\nTLS/SSL protocol encrypted records when CBC-mode cipher suites were used.\nA remote attacker could possibly use this flaw to retrieve plain text from\nthe encrypted packets by using a TLS/SSL server as a padding oracle.\n(CVE-2013-1619)\n\nUsers of GnuTLS are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. For the update to take\neffect, all applications linked to the GnuTLS library must be restarted,\nor the system rebooted.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2013-March/000817.html\n\n**Affected packages:**\ngnutls\ngnutls-devel\ngnutls-guile\ngnutls-utils\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2013-0588.html", "published": "2013-03-04T22:46:23", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://lists.centos.org/pipermail/centos-cr-announce/2013-March/000817.html", "cvelist": ["CVE-2013-1619"], "lastseen": "2018-04-04T13:00:21"}, {"id": "CESA-2013:0883", "type": "centos", "title": "gnutls security update", "description": "**CentOS Errata and Security Advisory** CESA-2013:0883\n\n\nThe GnuTLS library provides support for cryptographic algorithms and for\nprotocols such as Transport Layer Security (TLS).\n\nIt was discovered that the fix for the CVE-2013-1619 issue released via\nRHSA-2013:0588 introduced a regression in the way GnuTLS decrypted TLS/SSL\nencrypted records when CBC-mode cipher suites were used. A remote attacker\ncould possibly use this flaw to crash a server or client application that\nuses GnuTLS. (CVE-2013-2116)\n\nUsers of GnuTLS are advised to upgrade to these updated packages, which\ncorrect this issue. For the update to take effect, all applications linked\nto the GnuTLS library must be restarted.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2013-May/019766.html\nhttp://lists.centos.org/pipermail/centos-announce/2013-May/019767.html\n\n**Affected packages:**\ngnutls\ngnutls-devel\ngnutls-guile\ngnutls-utils\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2013-0883.html", "published": "2013-05-30T18:50:13", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2013-May/019766.html", "cvelist": ["CVE-2013-1619", "CVE-2013-2116"], "lastseen": "2017-10-03T18:24:46"}], "oraclelinux": [{"id": "ELSA-2013-0588", "type": "oraclelinux", "title": "gnutls security update", "description": "[2.8.5-10.1]\n- fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238)", "published": "2013-03-04T00:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://linux.oracle.com/errata/ELSA-2013-0588.html", "cvelist": ["CVE-2013-1619"], "lastseen": "2016-09-04T11:16:40"}, {"id": "ELSA-2013-0883", "type": "oraclelinux", "title": "gnutls security update", "description": "[2.8.5-10.2]\n- fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619\n upstream patch (#966754)", "published": "2013-05-30T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2013-0883.html", "cvelist": ["CVE-2013-1619", "CVE-2013-2116"], "lastseen": "2016-09-04T11:17:01"}, {"id": "ELSA-2014-0246", "type": "oraclelinux", "title": "gnutls security update", "description": "[2.8.5-13]\n- fix CVE-2014-0092 (#1069890)\n[2.8.5-12]\n- fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619\n upstream patch (#966754)\n[2.8.5-11]\n- fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238)", "published": "2014-03-03T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://linux.oracle.com/errata/ELSA-2014-0246.html", "cvelist": ["CVE-2013-1619", "CVE-2014-0092", "CVE-2013-2116"], "lastseen": "2016-09-04T11:15:57"}, {"id": "ELSA-2014-0247", "type": "oraclelinux", "title": "gnutls security update", "description": "[1.4.1-14]\n- Renamed gnutls-1.4.1-cve-2014-0092-1.patch to cve-2014-5138.patch\n- Renamed gnutls-1.4.1-cve-2014-0092-2.patch to cve-2014-0092.patch\n[1.4.1-13]\n- fix issues of CVE-2014-0092 (#1069888)\n[1.4.1-12]\n- fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619\n upstream patch (#966754)\n[1.4.1-11]\n- fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238)", "published": "2014-03-03T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://linux.oracle.com/errata/ELSA-2014-0247.html", "cvelist": ["CVE-2013-1619", "CVE-2009-5138", "CVE-2014-0092", "CVE-2014-5138", "CVE-2013-2116"], "lastseen": "2017-06-22T16:15:42"}], "redhat": [{"id": "RHSA-2013:0588", "type": "redhat", "title": "(RHSA-2013:0588) Moderate: gnutls security update", "description": "The GnuTLS library provides support for cryptographic algorithms and for\nprotocols such as Transport Layer Security (TLS).\n\nIt was discovered that GnuTLS leaked timing information when decrypting\nTLS/SSL protocol encrypted records when CBC-mode cipher suites were used.\nA remote attacker could possibly use this flaw to retrieve plain text from\nthe encrypted packets by using a TLS/SSL server as a padding oracle.\n(CVE-2013-1619)\n\nUsers of GnuTLS are advised to upgrade to these updated packages, which\ncontain a backported patch to correct this issue. For the update to take\neffect, all applications linked to the GnuTLS library must be restarted,\nor the system rebooted.\n", "published": "2013-03-04T05:00:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://access.redhat.com/errata/RHSA-2013:0588", "cvelist": ["CVE-2013-1619"], "lastseen": "2017-12-25T20:05:46"}, {"id": "RHSA-2013:0883", "type": "redhat", "title": "(RHSA-2013:0883) Important: gnutls security update", "description": "The GnuTLS library provides support for cryptographic algorithms and for\nprotocols such as Transport Layer Security (TLS).\n\nIt was discovered that the fix for the CVE-2013-1619 issue released via\nRHSA-2013:0588 introduced a regression in the way GnuTLS decrypted TLS/SSL\nencrypted records when CBC-mode cipher suites were used. A remote attacker\ncould possibly use this flaw to crash a server or client application that\nuses GnuTLS. (CVE-2013-2116)\n\nUsers of GnuTLS are advised to upgrade to these updated packages, which\ncorrect this issue. For the update to take effect, all applications linked\nto the GnuTLS library must be restarted.\n", "published": "2013-05-30T04:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2013:0883", "cvelist": ["CVE-2013-1619", "CVE-2013-2116"], "lastseen": "2017-12-25T20:05:46"}, {"id": "RHSA-2013:0636", "type": "redhat", "title": "(RHSA-2013:0636) Important: rhev-hypervisor6 security and bug fix update", "description": "The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization\nHypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor\nis a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes\neverything necessary to run and manage virtual machines: A subset of the\nRed Hat Enterprise Linux operating environment and the Red Hat Enterprise\nVirtualization Agent.\n\nNote: Red Hat Enterprise Virtualization Hypervisor is only available for\nthe Intel 64 and AMD64 architectures with virtualization extensions.\n\nA flaw was found in the way QEMU-KVM emulated the e1000 network interface\ncard when the host was configured to accept jumbo network frames, and a\nguest using the e1000 emulated driver was not. A remote attacker could use\nthis flaw to crash the guest or, potentially, execute arbitrary code with\nroot privileges in the guest. (CVE-2012-6075)\n\nIt was discovered that GnuTLS leaked timing information when decrypting\nTLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A\nremote attacker could possibly use this flaw to retrieve plain text from\nthe encrypted packets by using a TLS/SSL server as a padding oracle.\n(CVE-2013-1619)\n\nIt was discovered that OpenSSL leaked timing information when decrypting\nTLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites\nwere used. A remote attacker could possibly use this flaw to retrieve plain\ntext from the encrypted packets by using a TLS/SSL or DTLS server as a\npadding oracle. (CVE-2013-0169)\n\nA NULL pointer dereference flaw was found in the OCSP response verification\nin OpenSSL. A malicious OCSP server could use this flaw to crash\napplications performing OCSP verification by sending a specially-crafted\nresponse. (CVE-2013-0166)\n\nIt was discovered that the TLS/SSL protocol could leak information about\nplain text when optional compression was used. An attacker able to control\npart of the plain text sent over an encrypted TLS/SSL connection could\npossibly use this flaw to recover other portions of the plain text.\n(CVE-2012-4929)\n\nThis updated package provides updated components that include fixes for\nvarious security issues. These issues have no security impact on Red Hat\nEnterprise Virtualization Hypervisor itself, however. The security fixes\nincluded in this update address the following CVE numbers:\n\nCVE-2013-0292 (dbus-glib issue)\n\nCVE-2013-0228, CVE-2013-0268, and CVE-2013-0871 (kernel issues)\n\nCVE-2013-0338 (libxml2 issue)\n\nThis update contains the builds from the following errata:\n\novirt-node: RHBA-2013:0634\n https://rhn.redhat.com/errata/RHBA-2013-0634.html\nkernel: RHSA-2013:0630\n https://rhn.redhat.com/errata/RHSA-2013-0630.html\ndbus-glib: RHSA-2013:0568\n https://rhn.redhat.com/errata/RHSA-2013-0568.html\nlibcgroup: RHBA-2013:0560\n https://rhn.redhat.com/errata/RHBA-2013-0560.html\nvdsm: RHBA-2013:0635\n https://rhn.redhat.com/errata/RHBA-2013-0635.html\nselinux-policy: RHBA-2013:0618\n https://rhn.redhat.com/errata/RHBA-2013-0618.html\nqemu-kvm-rhev: RHSA-2013:0610\n https://rhn.redhat.com/errata/RHSA-2013-0610.html\nglusterfs: RHBA-2013:0620\n https://rhn.redhat.com/errata/RHBA-2013-0620.html\ngnutls: RHSA-2013:0588\n https://rhn.redhat.com/errata/RHSA-2013-0588.html\nipmitool: RHBA-2013:0572\n https://rhn.redhat.com/errata/RHBA-2013-0572.html\nlibxml2: RHSA-2013:0581\n https://rhn.redhat.com/errata/RHSA-2013-0581.html\nopenldap: RHBA-2013:0598\n https://rhn.redhat.com/errata/RHBA-2013-0598.html\nopenssl: RHSA-2013:0587\n https://rhn.redhat.com/errata/RHSA-2013-0587.html\n\nUsers of the Red Hat Enterprise Virtualization Hypervisor are advised to\nupgrade to this updated package, which fixes these issues.\n", "published": "2013-03-13T04:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2013:0636", "cvelist": ["CVE-2013-0166", "CVE-2013-0871", "CVE-2013-0228", "CVE-2013-0268", "CVE-2013-0169", "CVE-2013-1619", "CVE-2013-0338", "CVE-2013-0292", "CVE-2012-4929", "CVE-2012-6075"], "lastseen": "2017-03-10T07:18:47"}, {"id": "RHSA-2013:1076", "type": "redhat", "title": "(RHSA-2013:1076) Important: rhev-hypervisor6 security and bug fix update", "description": "The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization\nHypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor\nis a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes\neverything necessary to run and manage virtual machines: A subset of the\nRed Hat Enterprise Linux operating environment and the Red Hat Enterprise\nVirtualization Agent.\n\nNote: Red Hat Enterprise Virtualization Hypervisor is only available for\nthe Intel 64 and AMD64 architectures with virtualization extensions.\n\nIt was discovered that the fix for the CVE-2013-1619 issue released via\nRHSA-2013:0636 introduced a regression in the way GnuTLS decrypted TLS/SSL\nencrypted records when CBC-mode cipher suites were used. A remote attacker\ncould possibly use this flaw to crash a server or client application that\nuses GnuTLS. (CVE-2013-2116)\n\nThis updated package provides updated components that include fixes for\nvarious security issues. These issues have no security impact on Red Hat\nEnterprise Virtualization Hypervisor itself, however. The security fixes\nincluded in this update address the following CVE numbers:\n\nCVE-2013-2174 (curl issue)\n\nCVE-2012-6548, CVE-2013-0914, CVE-2013-1848, CVE-2013-2128, CVE-2013-2634,\nCVE-2013-2635, CVE-2013-2852, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225,\nand CVE-2013-3301 (kernel issues)\n\nCVE-2002-2443 (krb5 issue)\n\nCVE-2013-1950 (libtirpc issue)\n\nUpgrade Note: If you upgrade the Red Hat Enterprise Virtualization\nHypervisor through the 3.2 Manager administration portal, the Host may\nappear with the status of \"Install Failed\". If this happens, place the host\ninto maintenance mode, then activate it again to get the host back to an\n\"Up\" state. \n\nThis update also contains the fixes from the following errata:\n\n* ovirt-node: RHBA-2013:1077\n\nUsers of the Red Hat Enterprise Virtualization Hypervisor are advised to\nupgrade to this updated package, which corrects these issues.\n", "published": "2013-07-16T04:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2013:1076", "cvelist": ["CVE-2013-2635", "CVE-2012-6548", "CVE-2013-1950", "CVE-2013-1848", "CVE-2013-1619", "CVE-2013-3224", "CVE-2013-2852", "CVE-2013-3301", "CVE-2013-2128", "CVE-2013-3225", "CVE-2013-3222", "CVE-2013-0914", "CVE-2013-2174", "CVE-2013-2634", "CVE-2002-2443", "CVE-2013-2116"], "lastseen": "2017-03-10T07:18:24"}], "amazon": [{"id": "ALAS-2013-172", "type": "amazon", "title": "Medium: gnutls", "description": "**Issue Overview:**\n\nIt was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. ([CVE-2013-1619 __](<https://access.redhat.com/security/cve/CVE-2013-1619>))\n\n \n**Affected Packages:** \n\n\ngnutls\n\n \n**Issue Correction:** \nRun _yum update gnutls_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n gnutls-guile-2.8.5-10.9.amzn1.i686 \n gnutls-2.8.5-10.9.amzn1.i686 \n gnutls-debuginfo-2.8.5-10.9.amzn1.i686 \n gnutls-utils-2.8.5-10.9.amzn1.i686 \n gnutls-devel-2.8.5-10.9.amzn1.i686 \n \n src: \n gnutls-2.8.5-10.9.amzn1.src \n \n x86_64: \n gnutls-utils-2.8.5-10.9.amzn1.x86_64 \n gnutls-2.8.5-10.9.amzn1.x86_64 \n gnutls-devel-2.8.5-10.9.amzn1.x86_64 \n gnutls-debuginfo-2.8.5-10.9.amzn1.x86_64 \n gnutls-guile-2.8.5-10.9.amzn1.x86_64 \n \n \n", "published": "2013-03-14T22:04:00", "cvss": {"score": 4.0, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "https://alas.aws.amazon.com/ALAS-2013-172.html", "cvelist": ["CVE-2013-1619"], "lastseen": "2016-09-28T21:04:14"}, {"id": "ALAS-2013-197", "type": "amazon", "title": "Important: gnutls", "description": "**Issue Overview:**\n\nIt was discovered that the fix for the [CVE-2013-1619 __](<https://access.redhat.com/security/cve/CVE-2013-1619>) issue introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. ([CVE-2013-2116 __](<https://access.redhat.com/security/cve/CVE-2013-2116>))\n\n \n**Affected Packages:** \n\n\ngnutls\n\n \n**Issue Correction:** \nRun _yum update gnutls_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n gnutls-debuginfo-2.8.5-10.10.amzn1.i686 \n gnutls-devel-2.8.5-10.10.amzn1.i686 \n gnutls-2.8.5-10.10.amzn1.i686 \n gnutls-utils-2.8.5-10.10.amzn1.i686 \n gnutls-guile-2.8.5-10.10.amzn1.i686 \n \n src: \n gnutls-2.8.5-10.10.amzn1.src \n \n x86_64: \n gnutls-2.8.5-10.10.amzn1.x86_64 \n gnutls-utils-2.8.5-10.10.amzn1.x86_64 \n gnutls-guile-2.8.5-10.10.amzn1.x86_64 \n gnutls-debuginfo-2.8.5-10.10.amzn1.x86_64 \n gnutls-devel-2.8.5-10.10.amzn1.x86_64 \n \n \n", "published": "2013-06-11T22:44:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://alas.aws.amazon.com/ALAS-2013-197.html", "cvelist": ["CVE-2013-1619", "CVE-2013-2116"], "lastseen": "2016-09-28T21:04:14"}], "gentoo": [{"id": "GLSA-201310-18", "type": "gentoo", "title": "GnuTLS: Multiple vulnerabilities", "description": "### Background\n\nGnuTLS is an Open Source implementation of the TLS 1.2 and SSL 3.0 protocols. \n\n### Description\n\nMultiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers and Lucky Thirteen research paper referenced below for details. \n\n### Impact\n\nA remote attacker could sent a specially crafted packet to cause a Denial of Service condition. Additionally, a remote attacker could perform man-in-the-middle attacks to recover plaintext data. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll GnuTLS users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-libs/gnutls-2.12.23-r1\"", "published": "2013-10-28T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/201310-18", "cvelist": ["CVE-2013-1619", "CVE-2013-2116"], "lastseen": "2016-09-06T19:46:39"}], "suse": [{"id": "OPENSUSE-SU-2014:0346-1", "type": "suse", "title": "gnutls (critical)", "description": "The gnutls library was updated to fix SSL certificate\n validation. Remote man-in-the-middle attackers were able to\n make the verification believe that a SSL certificate is\n valid even though it was not. Also the TLS-CBC timing\n attack vulnerability was fixed.\n\n", "published": "2014-03-08T19:04:13", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html", "cvelist": ["CVE-2013-1619", "CVE-2014-0092"], "lastseen": "2016-09-04T11:35:13"}, {"id": "SUSE-SU-2014:0800-1", "type": "suse", "title": "Security update for GnuTLS (important)", "description": "GnuTLS has been patched to ensure proper parsing of session ids during the\n TLS/SSL handshake. Additionally three issues inherited from libtasn1 have\n been fixed.\n\n Further information is available at\n <a rel=\"nofollow\" href=\"http://www.gnutls.org/security.html#GNUTLS-SA-2014-3\">http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</a>\n <<a rel=\"nofollow\" href=\"http://www.gnutls.org/security.html#GNUTLS-SA-2014-3\">http://www.gnutls.org/security.html#GNUTLS-SA-2014-3</a>>\n\n These security issues have been fixed:\n\n * Possible memory corruption during connect (CVE-2014-3466)\n * Multiple boundary check issues could allow DoS (CVE-2014-3467)\n * asn1_get_bit_der() can return negative bit length (CVE-2014-3468)\n * Possible DoS by NULL pointer dereference (CVE-2014-3469)\n * Possible timing side-channel attack (Lucky 13) (CVE-2013-1619)\n\n One additional bug has been fixed:\n\n * Allow unsafe renegotiation (bnc#554084)\n", "published": "2014-06-16T18:04:14", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00020.html", "cvelist": ["CVE-2013-1619", "CVE-2014-3466", "CVE-2014-3468", "CVE-2014-3469", "CVE-2014-3467"], "lastseen": "2016-09-04T12:07:45"}, {"id": "SUSE-SU-2014:0322-1", "type": "suse", "title": "Security update for gnutls (critical)", "description": "The GnuTLS library received a critical security fix and\n other updates:\n\n * CVE-2014-0092: The X.509 certificate verification had\n incorrect error handling, which could lead to broken\n certificates marked as being valid.\n * CVE-2009-5138: A verification problem in handling V1\n certificates could also lead to V1 certificates incorrectly\n being handled.\n * CVE-2013-2116: The _gnutls_ciphertext2compressed\n function in lib/gnutls_cipher.c in GnuTLS allowed remote\n attackers to cause a denial of service (buffer over-read\n and crash) via a crafted padding length.\n * CVE-2013-1619: Timing attacks against hashing of\n padding was fixed which might have allowed disclosure of\n keys. (Lucky13 attack).\n\n Also the following non-security bugs have been fixed:\n\n * gnutls doesn't like root CAs without Basic\n Constraints. Permit V1 Certificate Authorities properly\n (bnc#760265)\n * memory leak in PSK authentication (bnc#835760)\n", "published": "2014-03-04T01:07:15", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html", "cvelist": ["CVE-2013-1619", "CVE-2009-5138", "CVE-2014-0092", "CVE-2013-2116"], "lastseen": "2016-09-04T12:09:51"}, {"id": "SUSE-SU-2014:0320-1", "type": "suse", "title": "Security update for gnutls (critical)", "description": "The GnuTLS library received a critical security fix and\n other updates:\n\n * CVE-2014-0092: The X.509 certificate verification had\n incorrect error handling, which could lead to broken\n certificates marked as being valid.\n * CVE-2009-5138: A verification problem in handling V1\n certificates could also lead to V1 certificates incorrectly\n being handled.\n * CVE-2013-2116: The _gnutls_ciphertext2compressed\n function in lib/gnutls_cipher.c in GnuTLS allowed remote\n attackers to cause a denial of service (buffer over-read\n and crash) via a crafted padding length.\n * CVE-2013-1619: The TLS implementation in GnuTLS did\n not properly consider timing side-channel attacks on a\n noncompliant MAC check operation during the processing of\n malformed CBC padding, which allows remote attackers to\n conduct distinguishing attacks and plaintext-recovery\n attacks via statistical analysis of timing data for crafted\n packets, a related issue to CVE-2013-0169. (Lucky13)\n * CVE-2012-1569: The asn1_get_length_der function in\n decoding.c in GNU Libtasn1 , as used in GnuTLS did not\n properly handle certain large length values, which allowed\n remote attackers to cause a denial of service (heap memory\n corruption and application crash) or possibly have\n unspecified other impact via a crafted ASN.1 structure.\n * CVE-2012-1573: gnutls_cipher.c in libgnutls in GnuTLS\n did not properly handle data encrypted with a block cipher,\n which allowed remote attackers to cause a denial of service\n (heap memory corruption and application crash) via a\n crafted record, as demonstrated by a crafted\n GenericBlockCipher structure.\n * CVE-2012-0390: The DTLS implementation in GnuTLS\n executed certain error-handling code only if there is a\n specific relationship between a padding length and the\n ciphertext size, which made it easier for remote attackers\n to recover partial plaintext via a timing side-channel\n attack, a related issue to CVE-2011-4108.\n\n Also some non security bugs have been fixed:\n\n * Did some more s390x size_t vs int fixes. (bnc#536809,\n bnc#659128)\n * re-enabled "legacy negotiation" (bnc#554084)\n * fix safe-renegotiation for sle10sp3 and sle10sp4 bug\n (bnc#554084)\n * fix bug bnc#536809, fix gnutls-cli to abort\n connection after detecting a bad certificate\n", "published": "2014-03-04T01:04:52", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html", "cvelist": ["CVE-2011-4108", "CVE-2013-0169", "CVE-2013-1619", "CVE-2009-5138", "CVE-2014-0092", "CVE-2012-0390", "CVE-2012-1569", "CVE-2012-1573", "CVE-2013-2116"], "lastseen": "2016-09-04T12:38:49"}]}}