Red Hat Security Advisory

RHSA-2025:16116

gnutls security, bug fix, and enhancement update

Released 2025-09-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) gnutls-c++-3.8.3-6.el9_6.2, gnutls-dane-3.8.3-6.el9_6.2, gnutls-devel-3.8.3-6.el9_6.2 +1
Red Hat Enterprise Linux BaseOS (v. 9) gnutls-3.8.3-6.el9_6.2

Fixes 4 records

TI-2025-24000 CVE-2025-32990 · GHSA-v8v5-8mm8-3j8p

Gnutls: vulnerability in gnutls certtool template parsing

MEDIUM 43

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00896 Published 2025-07-10 Partial fix · 3.8.10, 3.8.9-9.el10_0.14 +8 CWE-122

TI-2025-23998 CVE-2025-32988 · GHSA-fv5h-vqpf-6fqj

Gnutls: vulnerability in gnutls othername san export

LOW 39

A flaw was found in GnuTLS.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01475 Published 2025-07-10 Partial fix · 3.8.10, 3.8.9-9.el10_0.14 +8 CWE-415

TI-2025-05796 CVE-2025-6395 · GHSA-prf7-7jvx-hxj5

Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()

LOW 30

A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00771 Published 2025-07-10 Partial fix · 3.8.10, 3.8.9-9.el10_0.14 +7 CWE-476

TI-2025-23999 CVE-2025-32989 · GHSA-f7q5-qg45-7vm8

Gnutls: vulnerability in gnutls sct extension parsing

LOW 27

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01467 Published 2025-07-10 Partial fix · 3.8.10, 3.8.9-9.el10_0.14 +7 CWE-295