Package "gnutls28"
| Name: |
gnutls28
|
Description: |
This package is just an umbrella for a group of other packages,
it has no description.
Description samples from packages in group:
- GNU TLS library - documentation and examples
- GNU TLS library - development files
- GNU TLS library - OpenSSL wrapper
- dummy transitional package for GNU TLS library - development files
|
| Latest version: |
3.4.10-4ubuntu1.7 |
| Release: |
xenial (16.04) |
| Level: |
security |
| Repository: |
main |
Links
Other versions of "gnutls28" in Xenial
Packages in group
Deleted packages are displayed in grey.
Changelog
|
gnutls28 (3.4.10-4ubuntu1.7) xenial-security; urgency=medium
* SECURITY UPDATE: Allow re-enabling SHA1 for certificate signing with a
priority string (LP: #1860656)
- debian/patches/allow_broken_priority_string.patch: introduce the
%VERIFY_ALLOW_BROKEN priority string option.
- debian/patches/allow_sha1_priority_string.patch: introduce the
%VERIFY_ALLOW_SIGN_WITH_SHA1 priority string option.
-- Marc Deslauriers <email address hidden> Thu, 23 Jan 2020 08:47:43 -0500
|
| Source diff to previous version |
| 1860656 |
SHA1 security update regression prohibits connectivity |
|
|
gnutls28 (3.4.10-4ubuntu1.6) xenial-security; urgency=medium
* SECURITY UPDATE: Mark SHA1 as insecure for certificate signing
- debian/patches/insecuresha1-*.patch: backport upstream patches to
allow marking SHA1 as insecure, but only for certificate signing.
- debian/libgnutls30.symbols: added new symbol.
-- Marc Deslauriers <email address hidden> Wed, 08 Jan 2020 12:52:12 -0500
|
| Source diff to previous version |
|
gnutls28 (3.4.10-4ubuntu1.5) xenial-security; urgency=medium
* SECURITY UPDATE: Lucky-13 issues
- debian/patches/CVE-2018-1084x-1.patch: correctly account the length
field in SHA384 HMAC in lib/algorithms/mac.c, lib/gnutls_cipher.c.
- debian/patches/CVE-2018-1084x-2.patch: always hash the same amount of
blocks that would have been on minimum pad in lib/gnutls_cipher.c.
- debian/patches/CVE-2018-1084x-3.patch: require minimum padding under
SSL3.0 in lib/gnutls_cipher.c.
- debian/patches/CVE-2018-1084x-4.patch: hmac-sha384 and sha256
ciphersuites were removed from defaults in lib/gnutls_priority.c,
tests/priorities.c.
- debian/patches/CVE-2018-1084x-5.patch: fix test for SHA512 in
tests/pkcs12_encode.c.
- CVE-2018-10844
- CVE-2018-10845
- CVE-2018-10846
-- Marc Deslauriers <email address hidden> Tue, 28 May 2019 13:32:56 -0400
|
| Source diff to previous version |
| CVE-2018-1084 |
corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c. |
| CVE-2018-10844 |
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to |
| CVE-2018-10845 |
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to |
| CVE-2018-10846 |
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a c |
|
|
gnutls28 (3.4.10-4ubuntu1.3) xenial-security; urgency=medium
* SECURITY UPDATE: null pointer dereference via status response TLS
extension decoding
- debian/patches/CVE-2017-7507-1.patch: ensure response IDs are
properly deinitialized in lib/ext/status_request.c.
- debian/patches/CVE-2017-7507-2.patch: remove parsing of responder IDs
from client extension in lib/ext/status_request.c.
- debian/patches/CVE-2017-7507-3.patch: documented requirements for
parameters in lib/ext/status_request.c.
- CVE-2017-7507
* SECURITY UPDATE: DoS and possible code execution via OpenPGP
certificate decoding
- debian/patches/CVE-2017-7869.patch: enforce packet limits in
lib/opencdk/read-packet.c.
- CVE-2017-7869
-- Marc Deslauriers <email address hidden> Mon, 12 Jun 2017 09:32:37 -0400
|
| Source diff to previous version |
| CVE-2017-7507 |
Crash upon receiving well-formed status_request extension |
| CVE-2017-7869 |
GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function |
|
|
gnutls28 (3.4.10-4ubuntu1.2) xenial-security; urgency=medium
* SECURITY UPDATE: OCSP validation issue
- debian/patches/CVE-2016-7444.patch: correctly verify the serial
length in lib/x509/ocsp.c.
- CVE-2016-7444
* SECURITY UPDATE: denial of service via warning alerts
- debian/patches/CVE-2016-8610.patch: set a maximum number of warning
messages in lib/gnutls_int.h, lib/gnutls_handshake.c,
lib/gnutls_state.c.
- CVE-2016-8610
* SECURITY UPDATE: double-free when reading proxy language
- debian/patches/CVE-2017-5334.patch: fix double-free in
lib/x509/x509_ext.c.
- CVE-2017-5334
* SECURITY UPDATE: out of memory error in stream reading functions
- debian/patches/CVE-2017-5335.patch: add error checking to
lib/opencdk/read-packet.c.
- CVE-2017-5335
* SECURITY UPDATE: stack overflow in cdk_pk_get_keyid
- debian/patches/CVE-2017-5336.patch: check return code in
lib/opencdk/pubkey.c.
- CVE-2017-5336
* SECURITY UPDATE: heap read overflow when reading streams
- debian/patches/CVE-2017-5337.patch: add more precise checks to
lib/opencdk/read-packet.c.
- CVE-2017-5337
* debian/patches/fix_expired_certs.patch: use datefudge to fix test with
expired certs.
-- Marc Deslauriers <email address hidden> Thu, 26 Jan 2017 10:14:03 -0500
|
| CVE-2016-7444 |
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCS |
| CVE-2016-8610 |
SSL/TLS SSL3_AL_WARNING undefined alert DoS |
|
About
-
Send Feedback to @ubuntu_updates
