Linux Security
Linux Security
Linux Security

RedHat: RHSA-2021-1206:01 Important: gnutls and nettle security update

Date 14 Apr 2021
270
Posted By LinuxSecurity Advisories
An update for gnutls and nettle is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: gnutls and nettle security update
Advisory ID:       RHSA-2021:1206-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1206
Issue date:        2021-04-14
CVE Names:         CVE-2021-20305 
=====================================================================

1. Summary:

An update for gnutls and nettle is now available for Red Hat Enterprise
Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

The gnutls packages provide the GNU Transport Layer Security (GnuTLS)
library, which implements cryptographic algorithms and protocols such as
SSL, TLS, and DTLS.

Nettle is a cryptographic library that is designed to fit easily in almost
any context: In crypto toolkits for object-oriented languages, such as C++,
Python, or Pike, in applications like LSH or GNUPG, or even in kernel
space.

Security Fix(es):

* nettle: Out of bounds memory access in signature verification
(CVE-2021-20305)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1942533 - CVE-2021-20305 nettle: Out of bounds memory access in signature verification

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

aarch64:
gnutls-c++-3.6.14-8.el8_3.aarch64.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.aarch64.rpm
gnutls-dane-3.6.14-8.el8_3.aarch64.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.aarch64.rpm
gnutls-debuginfo-3.6.14-8.el8_3.aarch64.rpm
gnutls-debugsource-3.6.14-8.el8_3.aarch64.rpm
gnutls-devel-3.6.14-8.el8_3.aarch64.rpm
gnutls-utils-3.6.14-8.el8_3.aarch64.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.aarch64.rpm
nettle-debuginfo-3.4.1-4.el8_3.aarch64.rpm
nettle-debugsource-3.4.1-4.el8_3.aarch64.rpm
nettle-devel-3.4.1-4.el8_3.aarch64.rpm

ppc64le:
gnutls-c++-3.6.14-8.el8_3.ppc64le.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
gnutls-dane-3.6.14-8.el8_3.ppc64le.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
gnutls-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
gnutls-debugsource-3.6.14-8.el8_3.ppc64le.rpm
gnutls-devel-3.6.14-8.el8_3.ppc64le.rpm
gnutls-utils-3.6.14-8.el8_3.ppc64le.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
nettle-debuginfo-3.4.1-4.el8_3.ppc64le.rpm
nettle-debugsource-3.4.1-4.el8_3.ppc64le.rpm
nettle-devel-3.4.1-4.el8_3.ppc64le.rpm

s390x:
gnutls-c++-3.6.14-8.el8_3.s390x.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.s390x.rpm
gnutls-dane-3.6.14-8.el8_3.s390x.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.s390x.rpm
gnutls-debuginfo-3.6.14-8.el8_3.s390x.rpm
gnutls-debugsource-3.6.14-8.el8_3.s390x.rpm
gnutls-devel-3.6.14-8.el8_3.s390x.rpm
gnutls-utils-3.6.14-8.el8_3.s390x.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.s390x.rpm
nettle-debuginfo-3.4.1-4.el8_3.s390x.rpm
nettle-debugsource-3.4.1-4.el8_3.s390x.rpm
nettle-devel-3.4.1-4.el8_3.s390x.rpm

x86_64:
gnutls-c++-3.6.14-8.el8_3.i686.rpm
gnutls-c++-3.6.14-8.el8_3.x86_64.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.x86_64.rpm
gnutls-dane-3.6.14-8.el8_3.i686.rpm
gnutls-dane-3.6.14-8.el8_3.x86_64.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.x86_64.rpm
gnutls-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-debuginfo-3.6.14-8.el8_3.x86_64.rpm
gnutls-debugsource-3.6.14-8.el8_3.i686.rpm
gnutls-debugsource-3.6.14-8.el8_3.x86_64.rpm
gnutls-devel-3.6.14-8.el8_3.i686.rpm
gnutls-devel-3.6.14-8.el8_3.x86_64.rpm
gnutls-utils-3.6.14-8.el8_3.x86_64.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.x86_64.rpm
nettle-debuginfo-3.4.1-4.el8_3.i686.rpm
nettle-debuginfo-3.4.1-4.el8_3.x86_64.rpm
nettle-debugsource-3.4.1-4.el8_3.i686.rpm
nettle-debugsource-3.4.1-4.el8_3.x86_64.rpm
nettle-devel-3.4.1-4.el8_3.i686.rpm
nettle-devel-3.4.1-4.el8_3.x86_64.rpm

Red Hat Enterprise Linux BaseOS (v. 8):

Source:
gnutls-3.6.14-8.el8_3.src.rpm
nettle-3.4.1-4.el8_3.src.rpm

aarch64:
gnutls-3.6.14-8.el8_3.aarch64.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.aarch64.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.aarch64.rpm
gnutls-debuginfo-3.6.14-8.el8_3.aarch64.rpm
gnutls-debugsource-3.6.14-8.el8_3.aarch64.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.aarch64.rpm
nettle-3.4.1-4.el8_3.aarch64.rpm
nettle-debuginfo-3.4.1-4.el8_3.aarch64.rpm
nettle-debugsource-3.4.1-4.el8_3.aarch64.rpm

ppc64le:
gnutls-3.6.14-8.el8_3.ppc64le.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
gnutls-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
gnutls-debugsource-3.6.14-8.el8_3.ppc64le.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.ppc64le.rpm
nettle-3.4.1-4.el8_3.ppc64le.rpm
nettle-debuginfo-3.4.1-4.el8_3.ppc64le.rpm
nettle-debugsource-3.4.1-4.el8_3.ppc64le.rpm

s390x:
gnutls-3.6.14-8.el8_3.s390x.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.s390x.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.s390x.rpm
gnutls-debuginfo-3.6.14-8.el8_3.s390x.rpm
gnutls-debugsource-3.6.14-8.el8_3.s390x.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.s390x.rpm
nettle-3.4.1-4.el8_3.s390x.rpm
nettle-debuginfo-3.4.1-4.el8_3.s390x.rpm
nettle-debugsource-3.4.1-4.el8_3.s390x.rpm

x86_64:
gnutls-3.6.14-8.el8_3.i686.rpm
gnutls-3.6.14-8.el8_3.x86_64.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-c++-debuginfo-3.6.14-8.el8_3.x86_64.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-dane-debuginfo-3.6.14-8.el8_3.x86_64.rpm
gnutls-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-debuginfo-3.6.14-8.el8_3.x86_64.rpm
gnutls-debugsource-3.6.14-8.el8_3.i686.rpm
gnutls-debugsource-3.6.14-8.el8_3.x86_64.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.i686.rpm
gnutls-utils-debuginfo-3.6.14-8.el8_3.x86_64.rpm
nettle-3.4.1-4.el8_3.i686.rpm
nettle-3.4.1-4.el8_3.x86_64.rpm
nettle-debuginfo-3.4.1-4.el8_3.i686.rpm
nettle-debuginfo-3.4.1-4.el8_3.x86_64.rpm
nettle-debugsource-3.4.1-4.el8_3.i686.rpm
nettle-debugsource-3.4.1-4.el8_3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-20305
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYHdRUtzjgjWX9erEAQgAwA/+L5eeiWF1DMmqlmJnhRyWD2w4t8hWDdtV
dt+VUd5s40rD8C2AXJGzdxJa11qH0IG0acjfW0Pk4KIqdmpdmlhoaKrZBjzbsg3C
szbcEe+pc75HlmoNzVYgT5ux0IWt8pqR6Q2W3UTQZ3chQHqF4HMrlVBOVpyJrd3I
HHCHtwdP39F10h3EenYuLeCuGFkMDTtSx4YfWezGGhbsSmCURqDPznbTHlbiRa2c
WmtU6y52CMH7TSjcnU65sQ3N91p3YpstjBRWjjXEzbM5nnFk6AMyyk5Px8pRSRKg
ue1YM1Sc8r2BcJy0b2UiHKFIql3yj9ChMwvcwqNvi4fhIK34a58h7jZGvP+vdIPf
x4k7VnjBUSaVcrBOqlHsSqSQ2Bcbvnh6FkMvH7Hj3g370t9xXxhJhNPndbNw+omg
hXNfl17gQ/llQ6ilY9NzMGpmH+CC11rNwv7DPT6jbxzr8SuieIj1KdmXa5CesLlh
dOfe47GNi+UPr7JKKiC1WDCbsg+h+RmW1+Mr7KqqTtAIPSTDur+n3OZc9Xrxh5OF
YeW86P4Tq3w7wJVZsy6NVlGp2hlriLp+b8WqHoSV56yixgWNa8rJ5+bGD/kkEmxw
qJEByJTleozNdD70O9Jn6kMrVJbA/1QyD/HRDewGTj8LHh+LLOEjd+6GuAXc/vNf
DLNqEDu1kHo=
=50uL
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
This email address is being protected from spambots. You need JavaScript enabled to view it.
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Advisories

LinuxSecurity Poll

How frequently do you patch/update your system?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum 0 answer(s) and maximum 3 answer(s).
/main-polls/52-how-frequently-do-you-patch-update-your-system?task=poll.vote&format=json
52
radio
[{"id":"179","title":"As soon as patches\/updates are released - I track advisories for my distro(s) diligently","votes":"66","type":"x","order":"1","pct":75.86,"resources":[]},{"id":"180","title":"Every so often, when I think of it","votes":"14","type":"x","order":"2","pct":16.09,"resources":[]},{"id":"181","title":"Hardly ever","votes":"7","type":"x","order":"3","pct":8.05,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

Please vote first in order to view vote results.

VOTE ON THE POLL PAGE


VIEW MORE POLLS

bottom 200

Please enable / Bitte aktiviere JavaScript!
Veuillez activer / Por favor activa el Javascript![ ? ]

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.