Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 7: MGASA-2020-0268 Critical: GnuTLS Session Key Issue

mageia
Calendar Grey June 20, 2020
Dist Mageia Esm H88
OpenSSL patch resolves an SSL/TLS protocol vulnerability which leads to a session key issue. This could enable MitM (Man in the Middle) exploitation.
Updated gnutls packages fix security vulnerability: It was found that GnuTLS 3.6.4 introduced a regression in the TLS protocol implementation

Summary

Updated gnutls packages fix security vulnerability:
It was found that GnuTLS 3.6.4 introduced a regression in the TLS protocol implementation. This caused the TLS server to not securely construct a session ticket encryption key considering the application supplied secret, allowing a MitM attacker to bypass authentication in TLS 1.3 and recover previous conversations in TLS 1.2 (CVE-2020-13777).

References

- https://bugs.mageia.org/show_bug.cgi?id=26749

- https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03

- https://www.cve.org/CVERecord?id=CVE-2020-13777

Topics%20covered

Topics Covered

security advisory session key tls issue Mageia MitM

Resolution

SRPMS

- 7/core/gnutls-3.6.14-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 20 Jun 2020
URL: https://advisories.mageia.org/MGASA-2020-0268.html
Type: security
CVE: CVE-2020-13777

Topics%20covered

Topics Covered

security advisory session key tls issue Mageia MitM

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here