Red Hat Security Advisory

RHSA-2008:0489

gnutls security update

Released 2008-05-20 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) gnutls-1.4.1-3.el5_1, gnutls-1.4.1-3.el5_1.i386, gnutls-1.4.1-3.el5_1.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) gnutls-1.4.1-3.el5_1, gnutls-1.4.1-3.el5_1.i386, gnutls-utils-1.4.1-3.el5_1 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) gnutls-1.4.1-3.el5_1, gnutls-devel-1.4.1-3.el5_1, gnutls-devel-1.4.1-3.el5_1.i386

Fixes 3 records

TI-2008-01871 CVE-2008-1948 · GHSA-pc6g-9pg3-9q52

The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in…

MEDIUM 57

The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during ext…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.12018 Published 2008-05-21 Fixed CWE-189

TI-2008-01872 CVE-2008-1949 · GHSA-5mrf-xh4h-r8wx

The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in…

MEDIUM 49

The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, whic…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05772 Published 2008-05-21 Fixed CWE-287

TI-2008-01873 CVE-2008-1950 · GHSA-4qv6-g5fw-f876

Integer signedness error in the _gnutls_ciphertext2compressed function in…

LOW 31

Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a ce…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.04954 Published 2008-05-21 Fixed CWE-189