CVE-2019-3836

A flaw was found in the way gnutls handled malformed TLS 1.3 asynchronous messages. An attacker could use this flaw to crash an application compiled with gnutls via invalid pointer access...

CVE-2019-3829

A double free flaw was found in the way the certificate verification API was implemented for gnutls. An attacker could cause a client or server application compiled against gnutls to crash by parsing a specially-crafted certificate...

openSUSE Security Update : gnutls (openSUSE-2019-746)

This update for gnutls fixes the following security issues : - Improved mitigations against Lucky 13 class of attacks - CVE-2018-10846: 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery bsc1105460 - CVE-2018-10845: HMAC-SHA-384 vulnerable to Lucky thirtee...

GnuTLS -- double free, invalid pointer access

The GnuTLS project reports: Tavis Ormandy from Google Project Zero found a memory corruption double free vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected. It was found using the TLS fuzzer...

CVE-2019-3829

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption double free vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected...

UBUNTU-CVE-2019-3829

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption double free vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected...

EulerOS Virtualization 2.5.2 : libtasn1 (EulerOS-SA-2019-1082)

According to the version of the libtasn1 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Two errors in the 'asn1findnode' function lib/parseraux.c within GnuTLS libtasn1 version 4.10 can be exploited to cause a...

Updated gnutls packages fix security vulnerability

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade...

MGASA-2019-0103 Updated gnutls packages fix security vulnerability

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade...

The vulnerability of the GnuTLS cryptographic library, related to an error in verifying decrypted RSA data, allows a perpetrator to gain access to protected information.

The vulnerability of the GnuTLS cryptographic library is related to an error in the verification of decrypted RSA data. Exploiting this vulnerability could allow an attacker to gain access to protected information by using a secondary cache channel...

gnutls/gnutls_idna_parser_fuzzer: Use-of-uninitialized-value in _idn2_punycode_decode

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5637280142721024 Project: gnutls Fuzzer: libFuzzergnutlsidnaparserfuzzer Fuzz target binary: gnutlsidnaparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type:...

Security Bulletin: IBM MQ Appliance is affected by GnuTLS vulnerabilities (CVE-2018-10845 and CVE-2018-10844)

Summary IBM MQ Appliance has addressed the following GnuTLS vulnerabilities. Vulnerability Details CVEID: CVE-2018-10845 DESCRIPTION: GnuTLS could allow a remote attacker to obtain sensitive information, caused by a flaw in the implementation of HMAC-SHA-384. By sending a specially-crafted packet...

Security Bulletin: IBM Security Guardium is aware of a GnuTLS vulnerability

Summary IBM Security Guardium is aware of the following vulnerabilities Vulnerability Details CVE-2018-10846, CVE-2018-10845, CVE-2018-10844 Affected Products and Versions Affected IBM Security Guardium | Affected Versions ---|--- IBM Security Guardium | 9 - 9.5 IBM Security Guardium | 10 - 10.5...

EulerOS 2.0 SP3 : gnutls (EulerOS-SA-2019-1026)

According to the version of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls CVE-2018-10844 Note that Tenable Network Security h...

[ASA-201902-10] libcurl-gnutls: arbitrary code execution

Arch Linux Security Advisory ASA-201902-10 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-877 Summary...

Photon OS 1.0: Gnutls PHSA-2017-0015

An update of the gnutls package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0015. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121688;...

Photon OS 1.0: Gnutls PHSA-2017-0016

An update of the gnutls package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0016. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121691;...

Security Bulletin: IBM Flex System Manager (FSM) is affected by vulnerability (CVE-2014-3466)

Summary IBM Flex System Manager FSM is affected by gnutls vulnerability CVE-2014-3466 which could be used to create a buffer overflow. Vulnerability Details Abstract IBM Flex System Manager FSM is affected by gnutls vulnerability CVE-2014-3466 which could be used to create a buffer overflow...

Man-in-the-Middle (MitM)

gnutls is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is 1 not yet...

Information Leakage

The GnuTLS library is susceptible to information leakage. When CBC-mode cipher is used, attacker can use a TLS/SSL server as a padding oracle to decrypt the encrypted packets...