Out-of-bounds array read in gnutls26
Summary
DSA-2697-1: gnutls26 - out-of-bounds array read. Affects gnutls26 versions < 2.12.20-7. Fixed in 2.12.20-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is a secure communications library that implements the SSL, TLS, and DTLS protocols. It provides a robust and flexible framework for encrypting network communications. The gnutls26 package is a specific version of GnuTLS designed for Debian 7 (Wheezy). This package is vulnerable to an out-of-bounds array read issue.
Vulnerability Detail
The vulnerability in gnutls26 arises from a flaw in the handling of TLS records encrypted with a block cipher that contain invalid padding. A malicious client or server can exploit this flaw to crash the GnuTLS server or client, respectively. The impact of this vulnerability is a denial of service (DoS) attack, potentially disrupting the availability of the affected system.
How To Fix
Minimum fixed version
2.12.20-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnutls26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The gnutls26 package in Debian 7 (Wheezy) is vulnerable to an out-of-bounds array read issue. This vulnerability can be exploited by a malicious client or server to crash the GnuTLS server or client, resulting in a denial of service (DoS) attack. To mitigate this vulnerability, it is recommended to upgrade the gnutls26 package to version 2.12.20-7 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gnutls26 →
FAQ
GnuTLS is a secure communications library that implements SSL, TLS, and DTLS protocols. It provides encryption and authentication for network communications.
The vulnerability allows a malicious client or server to crash the GnuTLS server or client, respectively, resulting in a denial of service (DoS) attack.
No, the oldstable distribution is not affected because the security fix for this vulnerability was not applied to it.
The fixed version of gnutls26 is 2.12.20-7 or later.
You can upgrade gnutls26 by using the package manager of the Debian 7 (Wheezy) distribution and installing version 2.12.20-7 or later.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls26.
