Issued:
2019-11-05
Updated:
2019-11-05

RHSA-2019:3600 - Security Advisory

Synopsis

Moderate: gnutls security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

An update for gnutls is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

The following packages have been upgraded to a later upstream version: gnutls (3.6.8). (BZ#1689967)

Security Fix(es):

  • gnutls: use-after-free/double-free in certificate verification (CVE-2019-3829)
  • gnutls: invalid pointer access upon receiving async handshake messages (CVE-2019-3836)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1667427 - Multiple issues in implementation of record_size_limit extension (RFC 8449)
  • BZ - 1673975 - gnutls does not support multiple KeyUpdate messages on a connection
  • BZ - 1677048 - CVE-2019-3829 gnutls: use-after-free/double-free in certificate verification
  • BZ - 1678411 - CVE-2019-3836 gnutls: invalid pointer access upon receiving async handshake messages
  • BZ - 1680509 - Missing comparison with known good signature in RSA power on self test
  • BZ - 1680510 - Missing power on self tests for SHA3
  • BZ - 1684461 - Implement gnutls_aead_cipher_(en|de)crypt_vec() API in GnuTLS
  • BZ - 1684534 - p11tool fails to list private keys with 'pin-value' specified in PKCS#11 URI
  • BZ - 1686579 - GnuTLS server sends downgrade sentinel when negotiating TLS 1.3
  • BZ - 1686582 - Incorrect handling of fragmented KeyUpdate messages
  • BZ - 1690440 - selftest fails in FIPS mode
  • BZ - 1691448 - TLS Keying Material Exporter is unsupported by command line tools
  • BZ - 1705478 - gnutls fails with PKCS#11 URIs without module specification
  • BZ - 1706921 - GnuTLS should implement continuous random test or use the kernel AF_ALG interface for random

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
gnutls-3.6.8-8.el8.src.rpm SHA-256: 6f07038fb03f14aa80d8ddd60553be89c52499b1b918ff4c4cb0eb94e2a11969
x86_64
gnutls-3.6.8-8.el8.i686.rpm SHA-256: 65c5f9d07e105d9cb8e4171540f45bbd679b3a044c7a8914604b9ae47710a3f6
gnutls-3.6.8-8.el8.x86_64.rpm SHA-256: 7163d977c331a5f5b0b67ea22f085ecee19d42a5c7298b21ff90879c01346a81
gnutls-c++-3.6.8-8.el8.i686.rpm SHA-256: 5e00e94d7e37beb763299dfb018b75c620d8ac524864aac791453cca48a4d42f
gnutls-c++-3.6.8-8.el8.x86_64.rpm SHA-256: 31c4a2b62769a1763aebe3c9eb9c183fa000d0f9307ac4dddef5a09b19f83ff7
gnutls-c++-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: a5cf0b7125f561538b95ee03ca075572af9909d0c4105d03b3ede2861b61ecf2
gnutls-c++-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: a5cf0b7125f561538b95ee03ca075572af9909d0c4105d03b3ede2861b61ecf2
gnutls-c++-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: a2658cf243006185efa56d41e81bb984514f6b4bc6ba37f489a724146dc83540
gnutls-c++-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: a2658cf243006185efa56d41e81bb984514f6b4bc6ba37f489a724146dc83540
gnutls-dane-3.6.8-8.el8.i686.rpm SHA-256: 1ef0716fa2cdbb7482dd3a39f4675768ad5b565a24b7bde59a125d361576f4ed
gnutls-dane-3.6.8-8.el8.x86_64.rpm SHA-256: 6df7c235e686c4eb2ef8a3a14248439fe62845f275b39b0aabfd4866542b7438
gnutls-dane-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: a949dfa7207f5d8a423b9bfa061ff0ee5ddc9bd2d672bc824075a35dc53d1cf7
gnutls-dane-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: a949dfa7207f5d8a423b9bfa061ff0ee5ddc9bd2d672bc824075a35dc53d1cf7
gnutls-dane-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: 99b3478d791b2cd5adc37c313cea1ab3ed88360fd60fef8055ba15167206624a
gnutls-dane-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: 99b3478d791b2cd5adc37c313cea1ab3ed88360fd60fef8055ba15167206624a
gnutls-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: 452da991460ee44fbc549056a5ae2b0d31167525254cbb4a6db72f752565e9ca
gnutls-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: 452da991460ee44fbc549056a5ae2b0d31167525254cbb4a6db72f752565e9ca
gnutls-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: 455a92aab759e45dd2ce9fc6110bc93eb13777440b4bc8c8cecd7c9e1ec1d0e1
gnutls-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: 455a92aab759e45dd2ce9fc6110bc93eb13777440b4bc8c8cecd7c9e1ec1d0e1
gnutls-debugsource-3.6.8-8.el8.i686.rpm SHA-256: 8b0529245b91e00c2645ce7be8cb951aec669a0dc065967e38f82d3c8a8d1f43
gnutls-debugsource-3.6.8-8.el8.i686.rpm SHA-256: 8b0529245b91e00c2645ce7be8cb951aec669a0dc065967e38f82d3c8a8d1f43
gnutls-debugsource-3.6.8-8.el8.x86_64.rpm SHA-256: 53e456ff796671511aa89a2a932faf0f3c5a1e9f8fccf14e1765714d4a9f1586
gnutls-debugsource-3.6.8-8.el8.x86_64.rpm SHA-256: 53e456ff796671511aa89a2a932faf0f3c5a1e9f8fccf14e1765714d4a9f1586
gnutls-devel-3.6.8-8.el8.i686.rpm SHA-256: cb70892cd2ea0a6c31462ad4e9a31fbe9a356f99163f04b87fbb613c6eb8cbca
gnutls-devel-3.6.8-8.el8.x86_64.rpm SHA-256: e45f27c94d881514efba14e2c04143ac96ca2fe83c951669b8466d223d93e6d2
gnutls-utils-3.6.8-8.el8.x86_64.rpm SHA-256: 9ca5626c4c0dbffd9da7a3a2885cd9636ac390d3319df38ec97defe5e3e2b69a
gnutls-utils-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: 287d548423ad573b2cfe6ecd9981eb9fb4d0fa1ed4326fd80d36699317ed68a1
gnutls-utils-debuginfo-3.6.8-8.el8.i686.rpm SHA-256: 287d548423ad573b2cfe6ecd9981eb9fb4d0fa1ed4326fd80d36699317ed68a1
gnutls-utils-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: a8023b814df6d0e5bd37b36f6724c6f2b913a859d3d93a1eb06031629d5d9e8b
gnutls-utils-debuginfo-3.6.8-8.el8.x86_64.rpm SHA-256: a8023b814df6d0e5bd37b36f6724c6f2b913a859d3d93a1eb06031629d5d9e8b

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
gnutls-3.6.8-8.el8.src.rpm SHA-256: 6f07038fb03f14aa80d8ddd60553be89c52499b1b918ff4c4cb0eb94e2a11969
s390x
gnutls-3.6.8-8.el8.s390x.rpm SHA-256: 632e6c5f023922cc0544f7bd80fd6387ef39447a96595c26f48331be841a375d
gnutls-c++-3.6.8-8.el8.s390x.rpm SHA-256: d4401f86d7f87e13150d43cfb842360f12ae5cfdd332b02c4b9f1f95ce31bf3a
gnutls-c++-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: 1d4f5ed2cd1827e13ee9f821b91bcdbc70dc6ac0079f227bf3fd2c6492f0aa57
gnutls-c++-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: 1d4f5ed2cd1827e13ee9f821b91bcdbc70dc6ac0079f227bf3fd2c6492f0aa57
gnutls-dane-3.6.8-8.el8.s390x.rpm SHA-256: 86cc425ad5e0818d6a115f5c04e61063a2ee16e061ff870a0d4e12fa5038640e
gnutls-dane-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: ca51eef12bb5a1da2ef50a4b4728c55248c444a2cd2fd4974bcabfbddbd61080
gnutls-dane-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: ca51eef12bb5a1da2ef50a4b4728c55248c444a2cd2fd4974bcabfbddbd61080
gnutls-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: 5c36369dbc87ec91938fb67425d7cacc77e1a310733b82310fff02cd1366bd17
gnutls-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: 5c36369dbc87ec91938fb67425d7cacc77e1a310733b82310fff02cd1366bd17
gnutls-debugsource-3.6.8-8.el8.s390x.rpm SHA-256: 24dcfe50a732261240a91160b8e3c99f4c134d0c3967a830ef348ace186bc92d
gnutls-debugsource-3.6.8-8.el8.s390x.rpm SHA-256: 24dcfe50a732261240a91160b8e3c99f4c134d0c3967a830ef348ace186bc92d
gnutls-devel-3.6.8-8.el8.s390x.rpm SHA-256: b2b4715fce6976fb5fea94cbcec37f3acffbcbaa337db959d768b43ed26ac423
gnutls-utils-3.6.8-8.el8.s390x.rpm SHA-256: 31b7d6242d1a893a27c3b3947629769ffaba8bf463e98395fab98d3cf5fa1e71
gnutls-utils-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: 01ab65c4f072abbe239bb9e4b77306f348052315982b3ef921339de9b8399233
gnutls-utils-debuginfo-3.6.8-8.el8.s390x.rpm SHA-256: 01ab65c4f072abbe239bb9e4b77306f348052315982b3ef921339de9b8399233

Red Hat Enterprise Linux for Power, little endian 8

SRPM
gnutls-3.6.8-8.el8.src.rpm SHA-256: 6f07038fb03f14aa80d8ddd60553be89c52499b1b918ff4c4cb0eb94e2a11969
ppc64le
gnutls-3.6.8-8.el8.ppc64le.rpm SHA-256: 5c52218251796a0d9d8ef621fa412dfe9574f980b0420a52c0690708d7e83e1b
gnutls-c++-3.6.8-8.el8.ppc64le.rpm SHA-256: 15add4d506cfaf364c093fc62408cb0bf9d6ee49ba1f478c50bf3066744d5bf6
gnutls-c++-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: 5c6d9462efabfc0e8dc1f92b2e4659f17db18b2a0119663974b18c17b4a7cd07
gnutls-c++-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: 5c6d9462efabfc0e8dc1f92b2e4659f17db18b2a0119663974b18c17b4a7cd07
gnutls-dane-3.6.8-8.el8.ppc64le.rpm SHA-256: 0fa338785d4e5fb7f0d877de9a84f4f4000f08499cf544c39f08e70f1e776ea7
gnutls-dane-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: d2410643f33a636aee295ebd37233a503523f51241246f080b192c79ee9af854
gnutls-dane-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: d2410643f33a636aee295ebd37233a503523f51241246f080b192c79ee9af854
gnutls-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: 7bcf8250baa6cde14d47623dccef8487c7e9dd180c1c10cb289a1e4f59a6bdbe
gnutls-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: 7bcf8250baa6cde14d47623dccef8487c7e9dd180c1c10cb289a1e4f59a6bdbe
gnutls-debugsource-3.6.8-8.el8.ppc64le.rpm SHA-256: 5b69f65ab3ac424f28cd7406b3f8732edb236b4e5c852e44867123b2e046f1e9
gnutls-debugsource-3.6.8-8.el8.ppc64le.rpm SHA-256: 5b69f65ab3ac424f28cd7406b3f8732edb236b4e5c852e44867123b2e046f1e9
gnutls-devel-3.6.8-8.el8.ppc64le.rpm SHA-256: 3729b0127aeaa238c401b604b77a1357956590fdfccc76a28797faaf7add9e16
gnutls-utils-3.6.8-8.el8.ppc64le.rpm SHA-256: cdc3162ad57edebda76c1c275a66e3534e087afa5e438c4ecd070bd92d27c835
gnutls-utils-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: 92960f7a206ac3889965ee8710ed85462cfe6d88a5e55179e17be092134f2e50
gnutls-utils-debuginfo-3.6.8-8.el8.ppc64le.rpm SHA-256: 92960f7a206ac3889965ee8710ed85462cfe6d88a5e55179e17be092134f2e50

Red Hat Enterprise Linux for ARM 64 8

SRPM
gnutls-3.6.8-8.el8.src.rpm SHA-256: 6f07038fb03f14aa80d8ddd60553be89c52499b1b918ff4c4cb0eb94e2a11969
aarch64
gnutls-3.6.8-8.el8.aarch64.rpm SHA-256: 4e9e46e7c73e8009888d360245edb4fae69151a5c8640428cbb2286b23445612
gnutls-c++-3.6.8-8.el8.aarch64.rpm SHA-256: e7197eb71c6e268445fc670c6ade862be21c47bbb0e942d1f6c201bbc85ef0c7
gnutls-c++-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: 113289b70636f00483510228b8a96c131d0e6a4a44777f628f6cfd0245162501
gnutls-c++-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: 113289b70636f00483510228b8a96c131d0e6a4a44777f628f6cfd0245162501
gnutls-dane-3.6.8-8.el8.aarch64.rpm SHA-256: e273af70392a5aa368505441c05532657dc6a806260d8684754b23ba37f05644
gnutls-dane-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: 02e4086d13a5ad4fe158f6a9dfc3e075ca0cfc35bedea090840ef845b4c04c02
gnutls-dane-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: 02e4086d13a5ad4fe158f6a9dfc3e075ca0cfc35bedea090840ef845b4c04c02
gnutls-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: 28f81d6fc58b0ffed5edb7ad17c00938aa7d13a7c4f7bcc26322b63f7c38b2fe
gnutls-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: 28f81d6fc58b0ffed5edb7ad17c00938aa7d13a7c4f7bcc26322b63f7c38b2fe
gnutls-debugsource-3.6.8-8.el8.aarch64.rpm SHA-256: a05277bb4dcb5a82933dd8dd93f3a11169b642047ade15e4e45e7554c55a404d
gnutls-debugsource-3.6.8-8.el8.aarch64.rpm SHA-256: a05277bb4dcb5a82933dd8dd93f3a11169b642047ade15e4e45e7554c55a404d
gnutls-devel-3.6.8-8.el8.aarch64.rpm SHA-256: 5c9066520fdadb9313a7a04674ed06c4adc6f6ecedb184c317af510d19cf639e
gnutls-utils-3.6.8-8.el8.aarch64.rpm SHA-256: f09640a3410d6893ed37e10798a4b42e7a91fb870522592a7f659a7c25699c98
gnutls-utils-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: be736bc87d1060f7de27d270ffe3b158f3c48292cc4e2f78930df34b31ca03a5
gnutls-utils-debuginfo-3.6.8-8.el8.aarch64.rpm SHA-256: be736bc87d1060f7de27d270ffe3b158f3c48292cc4e2f78930df34b31ca03a5

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.