Scientific Linux SL6.x: SLSA-2017:0574-1 Moderate: gnutls Bug Fix Advisory

Date: Wed, 5 Apr 2017 15:04:24 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: gnutls on SL6.x i386/x86_64
MIME-Version: 1.0
Message-ID: <20170405150424.5357.7954@slpackages.fnal.gov>

Synopsis: Moderate: gnutls security, bug fix, and enhancement update
Advisory ID: SLSA-2017:0574-1
Issue Date: 2017-03-21
CVE Numbers: CVE-2016-8610
 CVE-2017-5337
 CVE-2017-5335
 CVE-2017-5336
--

The following packages have been upgraded to a later upstream version:
gnutls (2.12.23).

Security Fix(es):

* A denial of service flaw was found in the way the TLS/SSL protocol
defined processing of ALERT packets during a connection handshake. A
remote attacker could use this flaw to make a TLS/SSL server consume an
excessive amount of CPU and fail to accept connections form other clients.
(CVE-2016-8610)

* Multiple flaws were found in the way gnutls processed OpenPGP
certificates. An attacker could create specially crafted OpenPGP
certificates which, when parsed by gnutls, would cause it to crash.
(CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)
--

SL6
 x86_64
 gnutls-2.12.23-21.el6.i686.rpm
 gnutls-2.12.23-21.el6.x86_64.rpm
 gnutls-debuginfo-2.12.23-21.el6.i686.rpm
 gnutls-debuginfo-2.12.23-21.el6.x86_64.rpm
 gnutls-utils-2.12.23-21.el6.x86_64.rpm
 gnutls-devel-2.12.23-21.el6.i686.rpm
 gnutls-devel-2.12.23-21.el6.x86_64.rpm
 gnutls-guile-2.12.23-21.el6.i686.rpm
 gnutls-guile-2.12.23-21.el6.x86_64.rpm
 i386
 gnutls-2.12.23-21.el6.i686.rpm
 gnutls-debuginfo-2.12.23-21.el6.i686.rpm
 gnutls-utils-2.12.23-21.el6.i686.rpm
 gnutls-devel-2.12.23-21.el6.i686.rpm
 gnutls-guile-2.12.23-21.el6.i686.rpm

- Scientific Linux Development Team