Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2019:1477-1

Опубликовано: 30 мая 2019
Источник: suse-cvrf

Описание

Security update for gnutls

This update for gnutls fixes the following issues:

Security issue fixed:

  • CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification (bsc#1118087).

Non-security issue fixed:

  • Explicitly require libnettle 3.4.1 to prevent missing symbol errors (bsc#1134856).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.0
gnutls-3.6.7-lp151.2.3.1
gnutls-guile-3.6.7-lp151.2.3.1
libgnutls-dane-devel-3.6.7-lp151.2.3.1
libgnutls-dane0-3.6.7-lp151.2.3.1
libgnutls-devel-3.6.7-lp151.2.3.1
libgnutls-devel-32bit-3.6.7-lp151.2.3.1
libgnutls30-3.6.7-lp151.2.3.1
libgnutls30-32bit-3.6.7-lp151.2.3.1
libgnutlsxx-devel-3.6.7-lp151.2.3.1
libgnutlsxx28-3.6.7-lp151.2.3.1
openSUSE Leap 15.1
gnutls-3.6.7-lp151.2.3.1
gnutls-guile-3.6.7-lp151.2.3.1
libgnutls-dane-devel-3.6.7-lp151.2.3.1
libgnutls-dane0-3.6.7-lp151.2.3.1
libgnutls-devel-3.6.7-lp151.2.3.1
libgnutls-devel-32bit-3.6.7-lp151.2.3.1
libgnutls30-3.6.7-lp151.2.3.1
libgnutls30-32bit-3.6.7-lp151.2.3.1
libgnutlsxx-devel-3.6.7-lp151.2.3.1
libgnutlsxx28-3.6.7-lp151.2.3.1

Ссылки

Описание

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Затронутые продукты
openSUSE Leap 15.0:gnutls-3.6.7-lp151.2.3.1
openSUSE Leap 15.0:gnutls-guile-3.6.7-lp151.2.3.1
openSUSE Leap 15.0:libgnutls-dane-devel-3.6.7-lp151.2.3.1
openSUSE Leap 15.0:libgnutls-dane0-3.6.7-lp151.2.3.1
Ссылки