Advisory ROSA-SA-2021-1847

Software: gnutls 3.3.29
OS: Cobalt 7.9

CVE-ID: CVE-2014-3469
CVE-Crit: CRITICAL
CVE-DESC: The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allow context-sensitive attackers to cause a denial of service (dereferencing a NULL pointer and crashing) via a NULL value in the ivalue argument.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2014-3468
CVE-Crit: CRITICAL
CVE-DESC: The asn1_get_bit_der function in GNU Libtasn1 before version 3.6 incorrectly reports an error when a negative length in bits is defined, allowing context-sensitive attackers to invoke out-of-bounds access through created ASN.1 data.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2014-3467
CVE-Crit: CRITICAL
CVE-DESC: Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 prior to 3.6, which was used in GnuTLS, allow remote attackers to cause a denial of service (read out of range) via generated ASN.1 data.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2016-7444
CVE-Crit: HIGH
CVE-DESC: The gnutls_ocsp_resp_check_crt function in lib / x509 / ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not check the serial length of the OCSP response, which could allow remote attackers to bypass the intended certificate validation mechanism by using vectors that include completion bytes left by gnutls_malloc.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2018-16868
CVE-Crit: MEDIUM
CVE-DESC: An oracle attack based on a Bleichenbacher-type side-channel was detected in the way gnutls handles the validation of PKCS # 1 v1.5 data decrypted with RSA. An attacker who could run a process on the same physical core as the victim process could use this to extract the plaintext or, in some cases, downgrade any TLS connections to the vulnerable server.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2020-24659
CVE-Crit: HIGH
CVE-DESC: An issue was discovered in GnuTLS before 3.6.15. A server may initiate a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation warning is sent with an unexpected time and then an invalid second handshake occurs. The failure occurs in the application error handling path, where the gnutls_deinit function is called after a handshake failure is detected.
CVE-STATUS: default
CVE-REV: default