Synopsis

Moderate: gnutls security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

An update for gnutls is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

The following packages have been upgraded to a later upstream version: gnutls (3.3.29). (BZ#1561481)

Security Fix(es):

• gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls (CVE-2018-10844)
  
• gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant (CVE-2018-10845)
  
• gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery (CVE-2018-10846)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

• BZ - 1375307 - Deleting softhsm PKCS#11 objects does not work with p11tool --(so-)login
• BZ - 1434091 - Session renegotiation fails with client certificates
• BZ - 1444792 - Provide ability to set the expected server name in gnutls-serv utility [rhel-7]
• BZ - 1460125 - p11tool: cannot import private keys into Atos HSM
• BZ - 1464896 - p11tool cannot generate DSA keys
• BZ - 1561481 - Rebase gnutls to upstream version 3.3.29
• BZ - 1582571 - CVE-2018-10844 gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls
• BZ - 1582572 - CVE-2018-10845 gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant
• BZ - 1582574 - CVE-2018-10846 gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery

CVEs

• CVE-2018-10844
• CVE-2018-10845
• CVE-2018-10846

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index

Red Hat Enterprise Linux Server 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
x86_64
gnutls-3.3.29-8.el7.i686.rpm	SHA-256: 7bbef1f8440ec6e3197a370949ed3c64a13c181c918970d752fc26098966d929
gnutls-3.3.29-8.el7.x86_64.rpm	SHA-256: fa8da692248262ff8fca238cb283257597b3f63e16cf2a6c7050605e8e31a30e
gnutls-c++-3.3.29-8.el7.i686.rpm	SHA-256: aec569c165fa1e871216685c3cec1e4dcf82195d843bc69f6ffcac6fa8a69957
gnutls-c++-3.3.29-8.el7.x86_64.rpm	SHA-256: d5679d69f7725835a827f6facd38a547a512c916790cd87d521a66fb9845e848
gnutls-dane-3.3.29-8.el7.i686.rpm	SHA-256: 71925c40be6d2390f489ea5b71f4fa4fbee38608517dd50ca71d59bbf11d1ae4
gnutls-dane-3.3.29-8.el7.x86_64.rpm	SHA-256: 809a0ba15c5a2746a2369d2b6a1250e3772a2c4f40129d050b3b278407fc16db
gnutls-debuginfo-3.3.29-8.el7.i686.rpm	SHA-256: 5d1902aa05474d2a639f133229cf50bcbd5b90ff9c040412f2783ab0369d147a
gnutls-debuginfo-3.3.29-8.el7.x86_64.rpm	SHA-256: 87db54f4a37769d48bed1406fd3abf67613b78ecbb477509a3e26b8c70808ce0
gnutls-devel-3.3.29-8.el7.i686.rpm	SHA-256: fa30c573504b5a49e4a1abc4e084f901f4790152072bc90c150ba8cf9886b7ef
gnutls-devel-3.3.29-8.el7.x86_64.rpm	SHA-256: 6b59e1aab997e7d16e1a15c52cf2a97e4a01d6ae4ea970bdd2dc337f327ea3da
gnutls-utils-3.3.29-8.el7.x86_64.rpm	SHA-256: 23b913d897d09f09386c97916a595238377b77da83f8808729b7067d75b4a044

Red Hat Enterprise Linux Workstation 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
x86_64
gnutls-3.3.29-8.el7.i686.rpm	SHA-256: 7bbef1f8440ec6e3197a370949ed3c64a13c181c918970d752fc26098966d929
gnutls-3.3.29-8.el7.x86_64.rpm	SHA-256: fa8da692248262ff8fca238cb283257597b3f63e16cf2a6c7050605e8e31a30e
gnutls-c++-3.3.29-8.el7.i686.rpm	SHA-256: aec569c165fa1e871216685c3cec1e4dcf82195d843bc69f6ffcac6fa8a69957
gnutls-c++-3.3.29-8.el7.x86_64.rpm	SHA-256: d5679d69f7725835a827f6facd38a547a512c916790cd87d521a66fb9845e848
gnutls-dane-3.3.29-8.el7.i686.rpm	SHA-256: 71925c40be6d2390f489ea5b71f4fa4fbee38608517dd50ca71d59bbf11d1ae4
gnutls-dane-3.3.29-8.el7.x86_64.rpm	SHA-256: 809a0ba15c5a2746a2369d2b6a1250e3772a2c4f40129d050b3b278407fc16db
gnutls-debuginfo-3.3.29-8.el7.i686.rpm	SHA-256: 5d1902aa05474d2a639f133229cf50bcbd5b90ff9c040412f2783ab0369d147a
gnutls-debuginfo-3.3.29-8.el7.x86_64.rpm	SHA-256: 87db54f4a37769d48bed1406fd3abf67613b78ecbb477509a3e26b8c70808ce0
gnutls-devel-3.3.29-8.el7.i686.rpm	SHA-256: fa30c573504b5a49e4a1abc4e084f901f4790152072bc90c150ba8cf9886b7ef
gnutls-devel-3.3.29-8.el7.x86_64.rpm	SHA-256: 6b59e1aab997e7d16e1a15c52cf2a97e4a01d6ae4ea970bdd2dc337f327ea3da
gnutls-utils-3.3.29-8.el7.x86_64.rpm	SHA-256: 23b913d897d09f09386c97916a595238377b77da83f8808729b7067d75b4a044

Red Hat Enterprise Linux Desktop 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
x86_64
gnutls-3.3.29-8.el7.i686.rpm	SHA-256: 7bbef1f8440ec6e3197a370949ed3c64a13c181c918970d752fc26098966d929
gnutls-3.3.29-8.el7.x86_64.rpm	SHA-256: fa8da692248262ff8fca238cb283257597b3f63e16cf2a6c7050605e8e31a30e
gnutls-c++-3.3.29-8.el7.i686.rpm	SHA-256: aec569c165fa1e871216685c3cec1e4dcf82195d843bc69f6ffcac6fa8a69957
gnutls-c++-3.3.29-8.el7.x86_64.rpm	SHA-256: d5679d69f7725835a827f6facd38a547a512c916790cd87d521a66fb9845e848
gnutls-dane-3.3.29-8.el7.i686.rpm	SHA-256: 71925c40be6d2390f489ea5b71f4fa4fbee38608517dd50ca71d59bbf11d1ae4
gnutls-dane-3.3.29-8.el7.x86_64.rpm	SHA-256: 809a0ba15c5a2746a2369d2b6a1250e3772a2c4f40129d050b3b278407fc16db
gnutls-debuginfo-3.3.29-8.el7.i686.rpm	SHA-256: 5d1902aa05474d2a639f133229cf50bcbd5b90ff9c040412f2783ab0369d147a
gnutls-debuginfo-3.3.29-8.el7.i686.rpm	SHA-256: 5d1902aa05474d2a639f133229cf50bcbd5b90ff9c040412f2783ab0369d147a
gnutls-debuginfo-3.3.29-8.el7.x86_64.rpm	SHA-256: 87db54f4a37769d48bed1406fd3abf67613b78ecbb477509a3e26b8c70808ce0
gnutls-debuginfo-3.3.29-8.el7.x86_64.rpm	SHA-256: 87db54f4a37769d48bed1406fd3abf67613b78ecbb477509a3e26b8c70808ce0
gnutls-devel-3.3.29-8.el7.i686.rpm	SHA-256: fa30c573504b5a49e4a1abc4e084f901f4790152072bc90c150ba8cf9886b7ef
gnutls-devel-3.3.29-8.el7.x86_64.rpm	SHA-256: 6b59e1aab997e7d16e1a15c52cf2a97e4a01d6ae4ea970bdd2dc337f327ea3da
gnutls-utils-3.3.29-8.el7.x86_64.rpm	SHA-256: 23b913d897d09f09386c97916a595238377b77da83f8808729b7067d75b4a044

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
s390x
gnutls-3.3.29-8.el7.s390.rpm	SHA-256: 79ffda77788c1be1b98d30161283c9c8e72c44650bd130769a91d19627eef2f7
gnutls-3.3.29-8.el7.s390x.rpm	SHA-256: 316e83f1f748289288ad3ddc5d3d4866db9d5507cfc358ed395fcc74d7a9abfd
gnutls-c++-3.3.29-8.el7.s390.rpm	SHA-256: 17061d1792db4f4ce769c2b6b1eb2bcfe2bb19c87c483748744452793080c57e
gnutls-c++-3.3.29-8.el7.s390x.rpm	SHA-256: 3c97ec95b8bd1ba23312872e02878e77575279999587627664f050985250429c
gnutls-dane-3.3.29-8.el7.s390.rpm	SHA-256: eda3b66acbfde967909e7cf8fadee807a011af1a944475f4fb9dce97b7af3221
gnutls-dane-3.3.29-8.el7.s390x.rpm	SHA-256: 2f65d54b41cc5422784584dc504c67579e1a5bc0e74974afa98278f30d1988ef
gnutls-debuginfo-3.3.29-8.el7.s390.rpm	SHA-256: 94da4ae6765a0b2e3739d1eb53fb1bf3ec8920256e3d436a8faf9ca782b9e84b
gnutls-debuginfo-3.3.29-8.el7.s390x.rpm	SHA-256: 7f5b62fbec71a3350812652bf11fc2db85fd6fdcb8fa587042e8302702412ee3
gnutls-devel-3.3.29-8.el7.s390.rpm	SHA-256: 21acf5a45eb3329191308161b8cae2897a92d08d2cd8fe7f70b072df14b9bc96
gnutls-devel-3.3.29-8.el7.s390x.rpm	SHA-256: 0190b7354274ea833a78a8f2cdb18a5c7b2a5cb054c1fbf734949c085a51119e
gnutls-utils-3.3.29-8.el7.s390x.rpm	SHA-256: 8922f0cf87b9598683b3fd392db10990dbb191777f75eeb75879840ef518dbb5

Red Hat Enterprise Linux for Power, big endian 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
ppc64
gnutls-3.3.29-8.el7.ppc.rpm	SHA-256: 3ea4b96eeef84493cfd99ac79e6cb88b637a60ce494e5830d2d553165867dca2
gnutls-3.3.29-8.el7.ppc64.rpm	SHA-256: a04e4319a07b5369936da34e85868f6693ea14f90f17d8f692db37a271d02abe
gnutls-c++-3.3.29-8.el7.ppc.rpm	SHA-256: 7d6e10103f318820fe0f097515c565174567fa0ded2df535fa2401f67977c6db
gnutls-c++-3.3.29-8.el7.ppc64.rpm	SHA-256: 97883c73e0e5239cc131339797934178e004ad68d17276abb77320f54a89e594
gnutls-dane-3.3.29-8.el7.ppc.rpm	SHA-256: 7229607d880f341741a23b789ae557d5da07bad11496ce477305f42581d4d2a2
gnutls-dane-3.3.29-8.el7.ppc64.rpm	SHA-256: 635ee416c05fe9cadd022982ca6dd9385daacd6945078997e786ecf82df21354
gnutls-debuginfo-3.3.29-8.el7.ppc.rpm	SHA-256: af827d5c5088e3d351865f6765290efb8c07314e69669d8974165190122b0be7
gnutls-debuginfo-3.3.29-8.el7.ppc64.rpm	SHA-256: 8b558ebd5fad77897a90a6c9237339a49ecb369fbfc49ed3fdc6a9b10bb55c90
gnutls-devel-3.3.29-8.el7.ppc.rpm	SHA-256: 96c6888e01d8aff7f1db01461520df9d02bc3c879550653efb39153274d6e27b
gnutls-devel-3.3.29-8.el7.ppc64.rpm	SHA-256: dfc1176b3c474f0a3291ed03630553baa3eebaa22449c82911d324884cbd51f6
gnutls-utils-3.3.29-8.el7.ppc64.rpm	SHA-256: 193c4c2ae1535d5d8660e4bec93808f03a86608b3991e16c1d94db9e62ee298c

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
x86_64
gnutls-3.3.29-8.el7.i686.rpm	SHA-256: 7bbef1f8440ec6e3197a370949ed3c64a13c181c918970d752fc26098966d929
gnutls-3.3.29-8.el7.x86_64.rpm	SHA-256: fa8da692248262ff8fca238cb283257597b3f63e16cf2a6c7050605e8e31a30e
gnutls-c++-3.3.29-8.el7.i686.rpm	SHA-256: aec569c165fa1e871216685c3cec1e4dcf82195d843bc69f6ffcac6fa8a69957
gnutls-c++-3.3.29-8.el7.x86_64.rpm	SHA-256: d5679d69f7725835a827f6facd38a547a512c916790cd87d521a66fb9845e848
gnutls-dane-3.3.29-8.el7.i686.rpm	SHA-256: 71925c40be6d2390f489ea5b71f4fa4fbee38608517dd50ca71d59bbf11d1ae4
gnutls-dane-3.3.29-8.el7.x86_64.rpm	SHA-256: 809a0ba15c5a2746a2369d2b6a1250e3772a2c4f40129d050b3b278407fc16db
gnutls-debuginfo-3.3.29-8.el7.i686.rpm	SHA-256: 5d1902aa05474d2a639f133229cf50bcbd5b90ff9c040412f2783ab0369d147a
gnutls-debuginfo-3.3.29-8.el7.i686.rpm	SHA-256: 5d1902aa05474d2a639f133229cf50bcbd5b90ff9c040412f2783ab0369d147a
gnutls-debuginfo-3.3.29-8.el7.x86_64.rpm	SHA-256: 87db54f4a37769d48bed1406fd3abf67613b78ecbb477509a3e26b8c70808ce0
gnutls-debuginfo-3.3.29-8.el7.x86_64.rpm	SHA-256: 87db54f4a37769d48bed1406fd3abf67613b78ecbb477509a3e26b8c70808ce0
gnutls-devel-3.3.29-8.el7.i686.rpm	SHA-256: fa30c573504b5a49e4a1abc4e084f901f4790152072bc90c150ba8cf9886b7ef
gnutls-devel-3.3.29-8.el7.x86_64.rpm	SHA-256: 6b59e1aab997e7d16e1a15c52cf2a97e4a01d6ae4ea970bdd2dc337f327ea3da
gnutls-utils-3.3.29-8.el7.x86_64.rpm	SHA-256: 23b913d897d09f09386c97916a595238377b77da83f8808729b7067d75b4a044

Red Hat Enterprise Linux for Power, little endian 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
ppc64le
gnutls-3.3.29-8.el7.ppc64le.rpm	SHA-256: 612682ed436a3141a399c03d490d193148502ed63af119bc11cdbd486faaccc7
gnutls-c++-3.3.29-8.el7.ppc64le.rpm	SHA-256: 79c4ebecf80db7c76da1c650ebe026411313070acb5b0a082cffa2ad9950b8b3
gnutls-dane-3.3.29-8.el7.ppc64le.rpm	SHA-256: 5352481fa4c27ec58b15acca2fb754a18b6f0bc3d684dadb1b83b3bc6d31cdf0
gnutls-debuginfo-3.3.29-8.el7.ppc64le.rpm	SHA-256: f399df138b644a29e51998566606196210c0a25607d105643f9225f45f9eb883
gnutls-devel-3.3.29-8.el7.ppc64le.rpm	SHA-256: cd3f6f42069a158d46326bb5b55ddf10c6c7a3098d250f2d6c38a65107793ab6
gnutls-utils-3.3.29-8.el7.ppc64le.rpm	SHA-256: 45e748f2c3b540b787dd941c9c8cc481b2cf475584b41818e245b02efb05053d

Red Hat Enterprise Linux for ARM 64 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
aarch64
gnutls-3.3.29-8.el7.aarch64.rpm	SHA-256: d8ab10d6031ba0c99be7b92d3d51d9bbb69bded5a46db76528763221718c513a
gnutls-c++-3.3.29-8.el7.aarch64.rpm	SHA-256: 6bd4f69166319af939b9b571b9c424078a4e2b42dae9c59f1a43c248a26b97ad
gnutls-dane-3.3.29-8.el7.aarch64.rpm	SHA-256: 2f1863c3bfb40b1de7fb9be7fca323c09ba178b3841b0939d2803dc388ed92de
gnutls-debuginfo-3.3.29-8.el7.aarch64.rpm	SHA-256: 650e48eaa69de178e1a40227d5e8c106dfabf94496a74f8e50b78072b208e61b
gnutls-devel-3.3.29-8.el7.aarch64.rpm	SHA-256: e2a9bfcb3959303b552f5670d25d3866094cf9d905dd30abf92213c292b8d3c3
gnutls-utils-3.3.29-8.el7.aarch64.rpm	SHA-256: fe8358c9ed5d65785a629f3a7c83e5e36623bc11b5b91250835828b0863faab6

Red Hat Enterprise Linux for Power 9 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
ppc64le
gnutls-3.3.29-8.el7.ppc64le.rpm	SHA-256: 612682ed436a3141a399c03d490d193148502ed63af119bc11cdbd486faaccc7
gnutls-c++-3.3.29-8.el7.ppc64le.rpm	SHA-256: 79c4ebecf80db7c76da1c650ebe026411313070acb5b0a082cffa2ad9950b8b3
gnutls-dane-3.3.29-8.el7.ppc64le.rpm	SHA-256: 5352481fa4c27ec58b15acca2fb754a18b6f0bc3d684dadb1b83b3bc6d31cdf0
gnutls-debuginfo-3.3.29-8.el7.ppc64le.rpm	SHA-256: f399df138b644a29e51998566606196210c0a25607d105643f9225f45f9eb883
gnutls-devel-3.3.29-8.el7.ppc64le.rpm	SHA-256: cd3f6f42069a158d46326bb5b55ddf10c6c7a3098d250f2d6c38a65107793ab6
gnutls-utils-3.3.29-8.el7.ppc64le.rpm	SHA-256: 45e748f2c3b540b787dd941c9c8cc481b2cf475584b41818e245b02efb05053d

Red Hat Enterprise Linux for IBM System z (Structure A) 7

SRPM
gnutls-3.3.29-8.el7.src.rpm	SHA-256: 079a4a6a4ec7815a769665710fa82ae78aa2ec039add1f7091652d288f122be1
s390x
gnutls-3.3.29-8.el7.s390.rpm	SHA-256: 79ffda77788c1be1b98d30161283c9c8e72c44650bd130769a91d19627eef2f7
gnutls-3.3.29-8.el7.s390x.rpm	SHA-256: 316e83f1f748289288ad3ddc5d3d4866db9d5507cfc358ed395fcc74d7a9abfd
gnutls-c++-3.3.29-8.el7.s390.rpm	SHA-256: 17061d1792db4f4ce769c2b6b1eb2bcfe2bb19c87c483748744452793080c57e
gnutls-c++-3.3.29-8.el7.s390x.rpm	SHA-256: 3c97ec95b8bd1ba23312872e02878e77575279999587627664f050985250429c
gnutls-dane-3.3.29-8.el7.s390.rpm	SHA-256: eda3b66acbfde967909e7cf8fadee807a011af1a944475f4fb9dce97b7af3221
gnutls-dane-3.3.29-8.el7.s390x.rpm	SHA-256: 2f65d54b41cc5422784584dc504c67579e1a5bc0e74974afa98278f30d1988ef
gnutls-debuginfo-3.3.29-8.el7.s390.rpm	SHA-256: 94da4ae6765a0b2e3739d1eb53fb1bf3ec8920256e3d436a8faf9ca782b9e84b
gnutls-debuginfo-3.3.29-8.el7.s390x.rpm	SHA-256: 7f5b62fbec71a3350812652bf11fc2db85fd6fdcb8fa587042e8302702412ee3
gnutls-devel-3.3.29-8.el7.s390.rpm	SHA-256: 21acf5a45eb3329191308161b8cae2897a92d08d2cd8fe7f70b072df14b9bc96
gnutls-devel-3.3.29-8.el7.s390x.rpm	SHA-256: 0190b7354274ea833a78a8f2cdb18a5c7b2a5cb054c1fbf734949c085a51119e
gnutls-utils-3.3.29-8.el7.s390x.rpm	SHA-256: 8922f0cf87b9598683b3fd392db10990dbb191777f75eeb75879840ef518dbb5