Critical Security Update for GnuTLS: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:20613: Important: gnutls security update. Affects gnutls versions < 3.8.10-4.el10_2. Fixed in 3.8.10-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GnuTLS is a widely used library that implements the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, providing cryptographic functionalities for secure communication over networks. It is essential for applications that require secure data transmission. The library is utilized in various software packages and systems, making its security paramount. Recent vulnerabilities have been identified that could potentially compromise the integrity and confidentiality of data transmitted using GnuTLS.
Vulnerability Detail
The vulnerabilities in GnuTLS stem from multiple issues, including a flawed qsort comparator in DTLS reassembly, which can lead to denial of service attacks. Additionally, there are issues related to crashing on underflow with DTLS datagrams, RSA-PSK identity truncation, and case-sensitivity in domain name comparison. These vulnerabilities can allow attackers to exploit the library, potentially leading to data leaks or service disruptions.
How To Fix
Minimum fixed version
3.8.10-4.el10_2
This is the first release that contains the fix.
sudo dnf update gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if an immediate update is not feasible, consider disabling DTLS support in applications that utilize GnuTLS until the update can be applied. This can help mitigate the risk of exploitation until the vulnerabilities are resolved.
Conclusion
In summary, the recent vulnerabilities in GnuTLS pose significant risks to secure communications. It is essential to update to the latest patched version to mitigate these risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for gnutls →
FAQ
GnuTLS is a library that provides cryptographic protocols such as SSL and TLS for secure communication over networks.
The vulnerabilities include issues with DTLS reassembly, underflow crashes, RSA-PSK identity truncation, and domain name comparison.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without any signup.
Consider disabling DTLS support in your applications as a temporary workaround until you can apply the necessary updates.
For detailed information about the security issues, refer to the CVE pages associated with the vulnerabilities listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
