gnutls security update

2024-04-1500:00:00

linux.oracle.com

gnutls

security update

memory leak

older gmp

timing side-channel

deterministic ecdsa

unix

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

13.8%

JSON

[3.6.16-8.3_fips]

Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length
as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526]
Allow bigger known RSA modulus sizes when calling
rsa_generate_fips186_4_keypair directly [Orabug: 33200526]
Change Epoch from 1 to 10_fips
[3.6.16-8.3]
Fix memleak with older GMP (RHEL-28957)
[3.6.16-8.2]
Fix timing side-channel in deterministic ECDSA (RHEL-28957)
[3.6.16-8.1]
auth/rsa-psk: minimize branching after decryption (RHEL-21586)

OSVersionArchitecturePackageVersionFilename
oracle linux8srcgnutls< 3.6.16-8.el8_9.3gnutls-3.6.16-8.el8_9.3.src.rpm
oracle linux8srcgnutls< 3.6.16-8.el8_9.3gnutls-3.6.16-8.el8_9.3.src.rpm
oracle linux8srcgnutls< 3.6.16-8.el8_9.3gnutls-3.6.16-8.el8_9.3.src.rpm
oracle linux8srcgnutls< 3.6.16-8.el8_9.3_fipsgnutls-3.6.16-8.el8_9.3_fips.src.rpm
oracle linux8aarch64gnutls< 3.6.16-8.el8_9.3gnutls-3.6.16-8.el8_9.3.aarch64.rpm
oracle linux8aarch64gnutls< 3.6.16-8.el8_9.3gnutls-3.6.16-8.el8_9.3.aarch64.rpm
oracle linux8aarch64gnutls< 3.6.16-8.el8_9.3_fipsgnutls-3.6.16-8.el8_9.3_fips.aarch64.rpm
oracle linux8aarch64gnutls-c++< 3.6.16-8.el8_9.3gnutls-c++-3.6.16-8.el8_9.3.aarch64.rpm
oracle linux8aarch64gnutls-c++< 3.6.16-8.el8_9.3_fipsgnutls-c++-3.6.16-8.el8_9.3_fips.aarch64.rpm
oracle linux8aarch64gnutls-dane< 3.6.16-8.el8_9.3gnutls-dane-3.6.16-8.el8_9.3.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	8	src	gnutls	< 3.6.16-8.el8_9.3	gnutls-3.6.16-8.el8_9.3.src.rpm
oracle linux	8	src	gnutls	< 3.6.16-8.el8_9.3	gnutls-3.6.16-8.el8_9.3.src.rpm
oracle linux	8	src	gnutls	< 3.6.16-8.el8_9.3	gnutls-3.6.16-8.el8_9.3.src.rpm
oracle linux	8	src	gnutls	< 3.6.16-8.el8_9.3_fips	gnutls-3.6.16-8.el8_9.3_fips.src.rpm
oracle linux	8	aarch64	gnutls	< 3.6.16-8.el8_9.3	gnutls-3.6.16-8.el8_9.3.aarch64.rpm
oracle linux	8	aarch64	gnutls	< 3.6.16-8.el8_9.3	gnutls-3.6.16-8.el8_9.3.aarch64.rpm
oracle linux	8	aarch64	gnutls	< 3.6.16-8.el8_9.3_fips	gnutls-3.6.16-8.el8_9.3_fips.aarch64.rpm
oracle linux	8	aarch64	gnutls-c++	< 3.6.16-8.el8_9.3	gnutls-c++-3.6.16-8.el8_9.3.aarch64.rpm
oracle linux	8	aarch64	gnutls-c++	< 3.6.16-8.el8_9.3_fips	gnutls-c++-3.6.16-8.el8_9.3_fips.aarch64.rpm
oracle linux	8	aarch64	gnutls-dane	< 3.6.16-8.el8_9.3	gnutls-dane-3.6.16-8.el8_9.3.aarch64.rpm