132 matches found
Huawei EulerOS: Security Advisory for gnutls (EulerOS-SA-2024-2167)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-SU-2024:2546-1 Security update for gnutls
This update for gnutls fixes the following issues: - CVE-2024-28835: Fixed a certtool crash when verifying a certificate chain bsc1221747. - CVE-2024-28834: Fixed a side-channel attack in the deterministic ECDSA bsc1221746. Other fixes: - Fixed a memory leak when using the entropy collector...
EulerOS 2.0 SP11 : gnutls (EulerOS-SA-2024-1813)
According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leadi...
EulerOS 2.0 SP11 : gnutls (EulerOS-SA-2024-1834)
According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leadi...
gnutls: potential crash during chain building/verification
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command...
Oracle Linux 9 : gnutls (ELSA-2024-2570)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2570 advisory. 3.8.3-4 - Bump release to ensure el9 package is greater than el9 packages 3.8.3-3 - Bump release to ensure el9 package is greater than el9 packages...
gnutls: potential crash during chain building/verification
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command...
Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2024-591)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-591 advisory. A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios...
Fedora 40 : gnutls (2024-f69ecb0511)
The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f69ecb0511 advisory. Rebase gnutls to version 3.8.5 ---- Rebase gnutls to version 3.8.4 - contains fixes for CVE-2024-28834 and CVE-2024-28835 ---- Automatic update for...
OESA-2024-1507 gnutls security update
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...
OESA-2024-1508 gnutls security update
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...
OESA-2024-1470 gnutls security update
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...
gnutls: potential crash during chain building/verification
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command...
Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : GnuTLS vulnerabilities (USN-6733-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6733-1 advisory. It was discovered that GnuTLS had a timing side-channel when performing certain ECDSA operations. A remote attacker could possibly us...
Denial Of Service (DoS)
gnutls is vulnerable to Denial of ServiceDoS. The vulnerability is due to excessive resource consumption caused by the "certtool --verify-chain" command when verifying a specially crafted .pem bundle, leading to an application crash...
The vulnerability of the gnutls_x509_trust_list_verify_crt2() function in the GnuTLS security library allows a attacker to cause a service failure.
The vulnerability of the gnutlsx509trustlistverifycrt2 function in the GnuTLS security library is related to deficiencies in handling exceptional states during the analysis of the certlistsize parameter. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a...
Fedora 38 : gnutls (2024-af55471f75)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-af55471f75 advisory. Rebase gnutls to version 3.8.4 - contains fixes for CVE-2024-28834 and CVE-2024-28835 Tenable has extracted the preceding description block directly...
Updated gnutls packages fix security vulnerabilities
The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits,...
AZL-37108 CVE-2024-28835 affecting package gnutls for versions less than 3.8.3-2
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command...