Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 635
Alerts This Week
Warning Icon 1 635

SUSE: 2024:0638-2 Moderate: Gnutls Timing Attack And Certificate Issue

suse
Calendar Grey May 13, 2024
Dist Suse Esm H88
Revision for gnutls mitigates timing vulnerabilities and certificate chain weaknesses, bolstering protection on SUSE platforms.
* bsc#1218862 * bsc#1218865 Cross-References: * CVE-2024-0553

Summary

## This update for gnutls fixes the following issues: * CVE-2024-0567: Fixed an incorrect rejection of certificate chains with distributed trust (bsc#1218862). * CVE-2024-0553: Fixed a timing attack against the RSA-PSK key exchange, which could lead to the leakage of sensitive data (bsc#1218865). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-638=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-638=1 * SUSE Manager Server 4.3

Topics%20covered

Topics Covered

security advisory moderate severity timing attack SUSE Linux gnutls certificate issue

References

* bsc#1218862

* bsc#1218865

Cross-

* CVE-2024-0553

* CVE-2024-0567

CVSS scores:

* CVE-2024-0553 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

* CVE-2024-0553 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

* CVE-2024-0567 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2024-0567 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4

* SUSE Linux Enterprise High Performance Computing 15 SP4

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4

* SUSE Linux Enterprise Server 15 SP4

* SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

* SUSE Manager Proxy 4.3

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:0638-2
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate severity timing attack SUSE Linux gnutls certificate issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.