Red Hat Security AdvisoryRHSA-2015:1457
gnutls security and bug fix update
Released 2015-07-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) gnutls-2.8.5-18.el6, gnutls-utils-2.8.5-18.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) gnutls-devel-2.8.5-18.el6, gnutls-guile-2.8.5-18.el6
- Red Hat Enterprise Linux HPC Node (v. 6) gnutls-2.8.5-18.el6, gnutls-utils-2.8.5-18.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) gnutls-devel-2.8.5-18.el6, gnutls-guile-2.8.5-18.el6
- Red Hat Enterprise Linux Server (v. 6) gnutls-2.8.5-18.el6, gnutls-2.8.5-18.el6.ppc, gnutls-devel-2.8.5-18.el6 +2
- Red Hat Enterprise Linux Server Optional (v. 6) gnutls-guile-2.8.5-18.el6, gnutls-guile-2.8.5-18.el6.ppc
- Red Hat Enterprise Linux Workstation (v. 6) gnutls-2.8.5-18.el6, gnutls-devel-2.8.5-18.el6, gnutls-utils-2.8.5-18.el6
- Red Hat Enterprise Linux Workstation Optional (v. 6) gnutls-guile-2.8.5-18.el6
Fixes 3 records
Priority LOW 36
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01586 · Published 2020-01-27 · Partial fix · 3.3.13 CWE-295
Priority LOW 26
GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01397 · Published 2015-03-24 · Partial fix CWE-310
Priority LOW 22
GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet vali…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01046 · Published 2015-08-14 · Partial fix CWE-17
THREATIST.IORead the docs