UbuntuUpdates.org

Package "libgnutls30"

Name: libgnutls30

Description:

GNU TLS library - main runtime library
Latest version: 3.5.18-1ubuntu1.6
Release: bionic (18.04)
Level: updates
Repository: main
Head package: gnutls28
Homepage: http://www.gnutls.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libgnutls30"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libgnutls30" in Bionic

Repository Area Version
base main 3.5.18-1ubuntu1
security main 3.5.18-1ubuntu1.6

Changelog

Version: 3.5.18-1ubuntu1.6 2022-08-04 19:07:49 UTC

  gnutls28 (3.5.18-1ubuntu1.6) bionic-security; urgency=medium

  * SECURITY UPDATE: Null pointer dereference in MD_UPDATE
    - debian/patches/CVE-2021-4209.patch: avoid calling _update with
      zero-length input in lib/nettle/mac.c.
    - CVE-2021-4209
  * SECURITY UPDATE: Double free in verification of pkcs7 signatures
    - debian/patches/CVE-2022-2509.patch: fix double free during
      gnutls_pkcs7_verify in lib/x509/pkcs7.c,
      tests/pkcs7-verify-double-free.c, tests/Makefile.am.
    - CVE-2022-2509

 -- Marc Deslauriers <email address hidden> Tue, 02 Aug 2022 08:58:39 -0400
Source diff to previous version
CVE-2022-2509 A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_p

Version: 3.5.18-1ubuntu1.5 2021-09-15 17:06:15 UTC

  gnutls28 (3.5.18-1ubuntu1.5) bionic; urgency=medium

  * Backport patches from Upstream/Debian to check validity against system
    certs. This is to allow correctly validating default letsencrypt
    chains that now also include a redundant expired certficate. LP:
    #1928648

 -- Dimitri John Ledkov <email address hidden> Wed, 25 Aug 2021 19:11:11 +0100
Source diff to previous version

Version: 3.5.18-1ubuntu1.4 2020-07-02 15:07:51 UTC

  gnutls28 (3.5.18-1ubuntu1.4) bionic; urgency=medium

  * d/p/50_Update-session_ticket.c-to-add-support-for-zero-leng.patch:
    - add support for zero length session tickets returned from the server,
      thanks Rod for the backport and testing! (lp: #1876286)

 -- Sebastien Bacher <email address hidden> Wed, 17 Jun 2020 12:03:27 +0200
Source diff to previous version

Version: 3.5.18-1ubuntu1.3 2020-01-23 19:06:25 UTC

  gnutls28 (3.5.18-1ubuntu1.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Allow re-enabling SHA1 for certificate signing with a
    priority string (LP: #1860656)
    - debian/patches/allow_broken_priority_string.patch: introduce the
      %VERIFY_ALLOW_BROKEN priority string option.
    - debian/patches/allow_sha1_priority_string.patch: introduce the
      %VERIFY_ALLOW_SIGN_WITH_SHA1 priority string option.

 -- Marc Deslauriers <email address hidden> Thu, 23 Jan 2020 08:39:38 -0500
Source diff to previous version
1860656 SHA1 security update regression prohibits connectivity

Version: 3.5.18-1ubuntu1.2 2020-01-10 16:25:36 UTC

  gnutls28 (3.5.18-1ubuntu1.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Mark SHA1 as insecure for certificate signing
    - debian/patches/insecuresha1-*.patch: backport upstream patches to
      allow marking SHA1 as insecure, but only for certificate signing.
    - debian/libgnutls30.symbols: added new symbol.

 -- Marc Deslauriers <email address hidden> Wed, 08 Jan 2020 10:39:00 -0500


About   -   Send Feedback to @ubuntu_updates