Security update for gnutls SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0386-1 Final 1 1 2017-02-04T08:55:28Z current 2017-02-04T08:55:28Z 2017-02-04T08:55:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gnutls This update for gnutls fixes the following security issues: - GnuTLS could have crashed when processing maliciously crafted OpenPGP certificates (GNUTLS-SA-2017-2, bsc#1018832, CVE-2017-5335, CVE-2017-5337, CVE-2017-5336) - GnuTLS could have falsely accepted certificates when using OCSP (GNUTLS-SA-2016-3, bsc#999646, CVE-2016-7444) - GnuTLS could have suffered from 100% CPU load DoS attacks by using SSL alert packets during the handshake (bsc#1005879, CVE-2016-8610) This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html E-Mail link for openSUSE-SU-2017:0386-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 openSUSE Leap 42.2 gnutls-3.2.15-9.1 libgnutls-devel-3.2.15-9.1 libgnutls-devel-32bit-3.2.15-9.1 libgnutls-openssl-devel-3.2.15-9.1 libgnutls-openssl27-3.2.15-9.1 libgnutls28-3.2.15-9.1 libgnutls28-32bit-3.2.15-9.1 libgnutlsxx-devel-3.2.15-9.1 libgnutlsxx28-3.2.15-9.1 gnutls-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutls-devel-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutls-devel-32bit-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutls-openssl-devel-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutls-openssl27-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutls28-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutls28-32bit-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutlsxx-devel-3.2.15-9.1 as a component of openSUSE Leap 42.1 libgnutlsxx28-3.2.15-9.1 as a component of openSUSE Leap 42.1 gnutls-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutls-devel-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutls-devel-32bit-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutls-openssl-devel-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutls-openssl27-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutls28-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutls28-32bit-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutlsxx-devel-3.2.15-9.1 as a component of openSUSE Leap 42.2 libgnutlsxx28-3.2.15-9.1 as a component of openSUSE Leap 42.2 The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc. CVE-2016-7444 openSUSE Leap 42.1:gnutls-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx28-3.2.15-9.1 openSUSE Leap 42.2:gnutls-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx28-3.2.15-9.1 low 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html https://www.suse.com/security/cve/CVE-2016-7444.html CVE-2016-7444 https://bugzilla.suse.com/999646 SUSE Bug 999646 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. CVE-2016-8610 openSUSE Leap 42.1:gnutls-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx28-3.2.15-9.1 openSUSE Leap 42.2:gnutls-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx28-3.2.15-9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html https://www.suse.com/security/cve/CVE-2016-8610.html CVE-2016-8610 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1120592 SUSE Bug 1120592 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/982575 SUSE Bug 982575 The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate. CVE-2017-5335 openSUSE Leap 42.1:gnutls-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx28-3.2.15-9.1 openSUSE Leap 42.2:gnutls-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx28-3.2.15-9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html https://www.suse.com/security/cve/CVE-2017-5335.html CVE-2017-5335 https://bugzilla.suse.com/1018832 SUSE Bug 1018832 https://bugzilla.suse.com/1021057 SUSE Bug 1021057 Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate. CVE-2017-5336 openSUSE Leap 42.1:gnutls-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx28-3.2.15-9.1 openSUSE Leap 42.2:gnutls-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx28-3.2.15-9.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html https://www.suse.com/security/cve/CVE-2017-5336.html CVE-2017-5336 https://bugzilla.suse.com/1018832 SUSE Bug 1018832 https://bugzilla.suse.com/1021057 SUSE Bug 1021057 Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate. CVE-2017-5337 openSUSE Leap 42.1:gnutls-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-3.2.15-9.1 openSUSE Leap 42.1:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.1:libgnutlsxx28-3.2.15-9.1 openSUSE Leap 42.2:gnutls-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-devel-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutls-openssl27-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-3.2.15-9.1 openSUSE Leap 42.2:libgnutls28-32bit-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx-devel-3.2.15-9.1 openSUSE Leap 42.2:libgnutlsxx28-3.2.15-9.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html https://www.suse.com/security/cve/CVE-2017-5337.html CVE-2017-5337 https://bugzilla.suse.com/1018832 SUSE Bug 1018832 https://bugzilla.suse.com/1021057 SUSE Bug 1021057