[slackware-security] gnutls

New gnutls packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/gnutls-3.6.14-i586-1slack14.2.txz: Upgraded. Fixed insecure session ticket key construction, since 3.6.4. The TLS server would not bin...

GnuTLS -- flaw in TLS session ticket key construction

The GnuTLS project reports: It was found that GnuTLS 3.6.4 introduced a regression in the TLS protocol implementation. This caused the TLS server to not securely construct a session ticket encryption key considering the application supplied secret, allowing a MitM attacker to bypass authenticatio...

PT-2020-13675 · Gnu +7 · Gnutls +7

Name of the Vulnerable Software and Affected Versions: GnuTLS versions 3.6.4 through 3.6.14 Description: The issue is related to incorrect cryptography used for encrypting a session ticket, leading to a loss of confidentiality in TLS 1.2 and an authentication bypass in TLS 1.3. This allows an...

gnutls:gnutls_client_fuzzer: Null-dereference READ with empty stacktrace

Project: https://gitlab.com/gnutls/gnutls.git Detailed Report: https://oss-fuzz.com/testcase?key=5102053377703936 Project: gnutls Fuzzing Engine: afl Fuzz Target: gnutlsclientfuzzer Job Type: aflasangnutls Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash...

Insecure Random Number Generator

gnutls uses an insecure random number generator. The DTLS client hello contains a random value of all zeroes...

The vulnerability of the `send_client_hello` function in `handshake.c` of the GnuTLS cryptographic library is related to deficiencies in the cryptographic algorithms used. This vulnerability allows an attacker to gain unauthorized access to confidential data or compromise the integrity of the data.

The vulnerability of the sendclienthello function in the handshake.c file of the GnuTLS cryptographic library is related to deficiencies in the cryptographic algorithms used. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential data or compromise the...

CVE-2020-12823

OpenConnect 8.09 has a buffer overflow, causing a denial of service application crash or possibly unspecified other impact, via crafted certificate data to getcertname in gnutls.c...

CVE-2020-12823

OpenConnect 8.09 has a buffer overflow, causing a denial of service application crash or possibly unspecified other impact, via crafted certificate data to getcertname in gnutls.c...

UBUNTU-CVE-2020-12823

OpenConnect 8.09 has a buffer overflow, causing a denial of service application crash or possibly unspecified other impact, via crafted certificate data to getcertname in gnutls.c...

CVE-2020-12823

OpenConnect 8.09 contains a buffer overflow in get_cert_name (gnutls.c) triggered by crafted certificate data, leading to denial of service (crash) and potential further impact. Multiple connected advisories confirm the issue and note that OpenConnect 8.10 fixes it (upgrading is recommended). The...

Fedora: Security Advisory for mingw-gnutls (FEDORA-2020-d14280a6e8)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Oracle Linux 8 : gnutls (ELSA-2020-1998)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1998 advisory. 3.6.8-10 - Fix CVE-2020-11501 1826176 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus h...

Fedora: Security Advisory for mingw-gnutls (FEDORA-2020-f90fb78f70)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Denial Of Service (DoS)

GnuTLS is vulnerable to denial of service DoS. It is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application...

[SECURITY] Fedora 31 Update: mingw-gnutls-3.6.13-1.fc31

GnuTLS TLS/SSL encryption library. This library is cross-compiled for MinGW...

[SECURITY] Fedora 32 Update: mingw-gnutls-3.6.13-1.fc32

GnuTLS TLS/SSL encryption library. This library is cross-compiled for MinGW...

Fedora 31 : mingw-gnutls (2020-d14280a6e8)

https://lists.gnupg.org/pipermail/gnutls-help/2020-March/004642.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

gnutls security update

3.6.8-10 - Fix CVE-2020-11501 1826176...

samba security, bug fix, and enhancement update

openchange 2.3-24.0.1 - Add patch to build against samba 4.11 2.3-24 - Rebuild for newer samba and libldb samba 4.11.2-13 - resolves: 1802182 - Fix join using netbios name 4.11.2-12 - related: 1781232 - Improve debug output of smbclient - resolves: 1794461 - Do not return bogus inode numbers in...

gnutls: DTLS client hello contains a random value of all zeroes

A cryptographic weakness was found in the way DLTS implementation of GnuTLS, used zeros in place of random numbers. This flaw can break the security guarantee of the DTLS protocol...