Red Hat Security Advisory

RHSA-2024:0533

gnutls security update

Released 2024-01-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) gnutls-c++-3.7.6-23.el9_3.3, gnutls-dane-3.7.6-23.el9_3.3, gnutls-devel-3.7.6-23.el9_3.3 +1
Red Hat Enterprise Linux BaseOS (v. 9) gnutls-3.7.6-23.el9_3.3

Fixes 3 records

TI-2024-00525 CVE-2024-0567 · GHSA-mcx8-9rrj-7qxm

Gnutls: rejects certificate chain with distributed trust

HIGH 72

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01392 Published 2024-01-16 Partial fix · 3.8.3, 3.7.6-23.el9_3.3 +36 CWE-347

TI-2024-00511 CVE-2024-0553 · GHSA-x697-v25m-6phv

Gnutls: incomplete fix for cve-2023-5981

MEDIUM 42

A vulnerability was found in GnuTLS.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01614 Published 2024-01-16 Partial fix · 3.8.3, 3.6.16-8.el8_9.1 +39 CWE-203

TI-2023-05511 CVE-2023-5981 · GHSA-jvj3-gqjm-cg8p

Gnutls: timing side-channel in the rsa-psk authentication

LOW 29

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01267 Published 2023-11-28 Partial fix · 3.6.16-8.el8_9, 3.6.16-5.el8_6.2 +38 CWE-208