Moderate: gnutls security update
Summary
ALSA-2024:1879: Moderate: gnutls security update. Affects gnutls versions < 3.7.6-23.el9_3.4. Fixed in 3.7.6-23.el9_3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. It is widely used in various applications and systems to secure network communications.
Vulnerability Detail
The gnutls library is vulnerable to two security issues:
-
Minerva side-channel information leak (CVE-2024-28834): This vulnerability could allow an attacker to obtain sensitive information by exploiting a side-channel leak during cryptographic operations.
-
Potential crash during chain building/verification (CVE-2024-28835): This vulnerability could lead to a crash in the gnutls library when building or verifying certificate chains.
These vulnerabilities could be exploited by remote attackers to compromise the confidentiality, integrity, or availability of affected systems.
How To Fix
Minimum fixed version
3.7.6-23.el9_3.4
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities at this time.
Conclusion
It is crucial to promptly update the gnutls packages to address these vulnerabilities and ensure the security of the systems and applications utilizing the GnuTLS library. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for gnutls →
FAQ
These vulnerabilities could allow remote attackers to obtain sensitive information or cause a denial of service by crashing the affected systems.
There are no known exploits for these vulnerabilities at this time.
In most cases, it is not necessary to restart the systems after applying the update. However, it is recommended to consult the documentation or support resources specific to the operating system or distribution being used for any specific instructions.
In general, updating the gnutls packages to the fixed version should be sufficient to address the vulnerabilities. However, it is always recommended to perform thorough testing and validation after applying any security updates.
More information about these vulnerabilities, including the impact, CVSS score, acknowledgments, and related details, can be found on the respective CVE pages: CVE-2024-28834 and CVE-2024-28835.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
