Red Hat Security Advisory

RHSA-2017:0574

gnutls security, bug fix, and enhancement update

Released 2017-03-21 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) gnutls-2.12.23-21.el6, gnutls-utils-2.12.23-21.el6
Red Hat Enterprise Linux Desktop Optional (v. 6) gnutls-devel-2.12.23-21.el6, gnutls-guile-2.12.23-21.el6
Red Hat Enterprise Linux HPC Node (v. 6) gnutls-2.12.23-21.el6, gnutls-utils-2.12.23-21.el6
Red Hat Enterprise Linux HPC Node Optional (v. 6) gnutls-devel-2.12.23-21.el6, gnutls-guile-2.12.23-21.el6
Red Hat Enterprise Linux Server (v. 6) gnutls-2.12.23-21.el6, gnutls-2.12.23-21.el6.ppc, gnutls-devel-2.12.23-21.el6 +2
Red Hat Enterprise Linux Server Optional (v. 6) gnutls-guile-2.12.23-21.el6, gnutls-guile-2.12.23-21.el6.ppc
Red Hat Enterprise Linux Workstation (v. 6) gnutls-2.12.23-21.el6, gnutls-devel-2.12.23-21.el6, gnutls-utils-2.12.23-21.el6
Red Hat Enterprise Linux Workstation Optional (v. 6) gnutls-guile-2.12.23-21.el6

Fixes 4 records

TI-2016-07072 CVE-2016-8610 · GHSA-v2q2-jxh8-m5h8

Uncontrolled resource consumption in OpenSSL

MEDIUM 60

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.39919 Published 2017-11-13 Partial fix CWE-400

TI-2017-03380 CVE-2017-5336 · GHSA-93p2-4472-9gj5

Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in…

MEDIUM 52

Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.07071 Published 2017-03-24 Partial fix CWE-119

TI-2017-03381 CVE-2017-5337 · GHSA-c5c3-3h6m-3ghx

Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before…

MEDIUM 51

Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06179 Published 2017-03-24 Partial fix CWE-119

TI-2017-03379 CVE-2017-5335 · GHSA-3wcr-vccv-4fcx

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and…

MEDIUM 44

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certifica…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08009 Published 2017-03-24 Partial fix CWE-125