Moderate: gnutls security update
Summary
ALSA-2024:0533: Moderate: gnutls security update. Affects gnutls versions < 3.7.6-23.el9_3.3. Fixed in 3.7.6-23.el9_3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. GnuTLS is widely used in various applications and systems to secure network communications.
Vulnerability Detail
This vulnerability, identified as CVE-2023-5981, is a timing side-channel in the RSA-PSK authentication. It allows an attacker to potentially exploit the timing information to recover the RSA-PSK key. An incomplete fix for CVE-2023-5981, identified as CVE-2024-0553, is also present in the gnutls packages. Additionally, the packages reject a certificate chain with distributed trust, which is identified as CVE-2024-0567. These vulnerabilities can lead to unauthorized access, data leakage, and potential compromise of the secure communication channels.
How To Fix
Minimum fixed version
3.7.6-23.el9_3.3
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the security update as soon as possible to ensure the integrity and security of your system.
Conclusion
To mitigate these vulnerabilities, it is crucial to update the gnutls packages to version 3.7.6-23.el9_3.3 or later. This update includes the necessary fixes and improvements to address the identified security issues. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is a library that implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. It is widely used to secure network communications in various applications and systems.
These vulnerabilities can potentially allow an attacker to gain unauthorized access, leak sensitive information, and compromise the security of the communication channels protected by GnuTLS.
No, only versions prior to 3.7.6-23.el9_3.3 are affected. It is recommended to update to the latest version to mitigate these vulnerabilities.
No, there are no known workarounds for these vulnerabilities. It is essential to apply the security update to protect your system.
You can update the gnutls packages using the package manager of your AlmaLinux 9 system. Ensure that you have the latest updates and security patches installed.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
