MGASA-2020-0379 - Updated gnutls packages fix security vulnerability

Publication date: 30 Sep 2020
URL: https://advisories.mageia.org/MGASA-2020-0379.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-24659

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL
pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent
with unexpected timing, and then an invalid second handshake occurs. The crash
happens in the application's error handling path, where the gnutls_deinit
function is called after detecting a handshake failure (CVE-2020-24659).

References:
- https://bugs.mageia.org/show_bug.cgi?id=27257
- https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-09-04
- https://lists.gnupg.org/pipermail/gnutls-help/2020-September/004669.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24659

SRPMS:
- 7/core/gnutls-3.6.15-1.mga7