Critical Security Update for GnuTLS: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:20611: Important: gnutls security update. Affects gnutls versions < 3.6.16-8.el8_10.6. Fixed in 3.6.16-8.el8_10.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is a widely used library that implements cryptographic protocols such as SSL, TLS, and DTLS. It is essential for secure communications over networks, providing functionalities like encryption and authentication. The library is integral to many applications and services, making its security paramount. Recent vulnerabilities have been identified that could compromise the integrity and security of systems relying on GnuTLS.
Vulnerability Detail
The vulnerabilities in GnuTLS stem from inadequate checks and flaws in the DTLS reassembly process, which could lead to crashes or unintended behavior. Specifically, issues such as underflow in DTLS datagrams, improper handling of RSA-PSK identities, and case-sensitivity in domain name comparisons have been identified. These vulnerabilities could allow attackers to exploit the library, potentially leading to denial of service or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
3.6.16-8.el8_10.6
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the use of affected features in GnuTLS until the update is applied. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The identified vulnerabilities in GnuTLS pose significant risks to applications relying on this library for secure communications. It is crucial to update to the patched version to mitigate these risks and ensure the integrity of your systems. Regular monitoring and updates are essential for maintaining security in open-source software.
See every vulnerability recorded for gnutls →
FAQ
The main vulnerabilities include issues with DTLS reassembly, RSA-PSK identity truncation, and case-sensitivity in domain name comparisons.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, consider restricting the use of affected features as a temporary workaround.
Exploiting these vulnerabilities could lead to denial of service attacks or unauthorized access to sensitive information, compromising the security of applications using GnuTLS.
For more details, refer to the CVE pages linked in the security advisory, which provide in-depth information about each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
