Red Hat Security AdvisoryRHSA-2017:2292
gnutls security, bug fix, and enhancement update
Released 2017-08-01 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) gnutls-3.3.26-9.el7, gnutls-dane-3.3.26-9.el7, gnutls-utils-3.3.26-9.el7
- Red Hat Enterprise Linux Client Optional (v. 7) gnutls-c++-3.3.26-9.el7, gnutls-devel-3.3.26-9.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) gnutls-3.3.26-9.el7, gnutls-dane-3.3.26-9.el7, gnutls-utils-3.3.26-9.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) gnutls-c++-3.3.26-9.el7, gnutls-devel-3.3.26-9.el7
- Red Hat Enterprise Linux Server (v. 7) gnutls-3.3.26-9.el7, gnutls-3.3.26-9.el7.ppc, gnutls-c++-3.3.26-9.el7 +6
- Red Hat Enterprise Linux Workstation (v. 7) gnutls-3.3.26-9.el7, gnutls-c++-3.3.26-9.el7, gnutls-dane-3.3.26-9.el7 +2
Fixes 7 records
Priority HIGH 67
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.32754 · Published 2017-03-24 · Fixed CWE-415
Priority MEDIUM 52
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07071 · Published 2017-03-24 · Partial fix CWE-119
Priority MEDIUM 51
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06179 · Published 2017-03-24 · Partial fix CWE-119
Priority MEDIUM 44
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certifica…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.08009 · Published 2017-03-24 · Partial fix CWE-125
Priority LOW 39
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.0341 · Published 2017-06-16 · Fixed CWE-476
Priority LOW 38
GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02862 · Published 2017-04-14 · Partial fix CWE-787
Priority LOW 37
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended ce…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02437 · Published 2016-09-27 · Fixed CWE-264
THREATIST.IORead the docs