Ubuntu: USN-2865-1 Moderate: GnuTLS Man-In-The-Middle Threat

ubuntu

January 8, 2016

GnuTLS could be made to expose sensitive information over the network.

Summary

GnuTLS could be made to expose sensitive information over the network.

Software Description:

- gnutls28: GNU TLS library

- gnutls26: GNU TLS library

Details:

Karthikeyan Bhargavan and Gaetan Leurent discovered that GnuTLS incorrectly

allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could be exploited to

view sensitive information.

Topics Covered

security advisory moderate ubuntu gnutls network exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  libgnutls-deb0-28               3.3.8-3ubuntu3.2
  libgnutls-openssl27             3.3.8-3ubuntu3.2
  libgnutlsxx28                   3.3.8-3ubuntu3.2

Ubuntu 14.04 LTS:
  libgnutls-openssl27             2.12.23-12ubuntu2.4
  libgnutls26                     2.12.23-12ubuntu2.4
  libgnutlsxx27                   2.12.23-12ubuntu2.4

Ubuntu 12.04 LTS:
  libgnutls-openssl27             2.12.14-5ubuntu3.11
  libgnutls26                     2.12.14-5ubuntu3.11
  libgnutlsxx27                   2.12.14-5ubuntu3.11

In general, a standard system update will make all the necessary changes.