Moderate: gnutls security update
Summary
ALSA-2024:1784: Moderate: gnutls security update. Affects gnutls versions < 3.6.16-8.el8_9.3. Fixed in 3.6.16-8.el8_9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gnutls package provides the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. It is widely used in various applications and systems to secure network communications.
Vulnerability Detail
A timing side-channel vulnerability has been discovered in the deterministic ECDSA implementation of gnutls. This vulnerability, known as Minerva side-channel information leak (CVE-2024-28834), could allow an attacker to extract sensitive information by measuring the timing of cryptographic operations. An attacker with local access to the system or a remote attacker with sufficient network access could exploit this vulnerability to obtain private key material or other sensitive information.
How To Fix
Minimum fixed version
3.6.16-8.el8_9.3
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security update as soon as possible.
Conclusion
The gnutls package is vulnerable to a timing side-channel information leak. It is crucial to update the package to the latest version to mitigate the risk of sensitive information exposure. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is a library that provides secure communication over networks using various cryptographic algorithms and protocols such as SSL, TLS, and DTLS.
A timing side-channel vulnerability is a type of security flaw that allows an attacker to gain information by measuring the time taken by certain operations. In this case, the vulnerability allows an attacker to extract sensitive information by measuring the timing of cryptographic operations.
This vulnerability could allow an attacker to obtain private key material or other sensitive information, potentially compromising the security of encrypted communications.
Users of systems or applications that use the gnutls library for secure communication are affected by this vulnerability. It is recommended to update the gnutls package to mitigate the risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will analyze the dependencies for any known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
