openSUSE-SU-2020:0790-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2020:0790-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2020:0790-1
Related
Published
2020-06-10T17:41:13Z
Modified
2020-06-10T17:41:13Z
Summary
Security update for gnutls
Details

This update for gnutls fixes the following issues:

  • CVE-2020-13777: Fixed an insecure session ticket key construction which could have made the TLS server to not bind the session ticket encryption key with a value supplied by the application until the initial key rotation, allowing an attacker to bypass authentication in TLS 1.3 and recover previous conversations in TLS 1.2 (bsc#1172506).
  • Fixed an improper handling of certificate chain with cross-signed intermediate CA certificates (bsc#1172461).

This update was imported from the SUSE:SLE-15:Update update project.

References

Affected packages

openSUSE:Leap 15.1 / gnutls

Package

Name
gnutls
Purl
purl:rpm/suse/gnutls&distro=openSUSE%20Leap%2015.1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.7-lp151.2.18.1

Ecosystem specific 

{
    "binaries": [
        {
            "gnutls-guile": "3.6.7-lp151.2.18.1",
            "libgnutls30-32bit": "3.6.7-lp151.2.18.1",
            "libgnutlsxx-devel": "3.6.7-lp151.2.18.1",
            "gnutls": "3.6.7-lp151.2.18.1",
            "libgnutls30-hmac": "3.6.7-lp151.2.18.1",
            "libgnutls-devel-32bit": "3.6.7-lp151.2.18.1",
            "libgnutls-dane0": "3.6.7-lp151.2.18.1",
            "libgnutls-dane-devel": "3.6.7-lp151.2.18.1",
            "libgnutls30": "3.6.7-lp151.2.18.1",
            "libgnutls-devel": "3.6.7-lp151.2.18.1",
            "libgnutls30-hmac-32bit": "3.6.7-lp151.2.18.1",
            "libgnutlsxx28": "3.6.7-lp151.2.18.1"
        }
    ]
}