Ubuntu 24.10 USN-7281-1 Critical: GnuTLS Resource Exhaustion

ubuntu

February 20, 2025

GnuTLS could be made to consume resources if it decoded specially crafted certificates.

Summary

GnuTLS could be made to consume resources if it decoded specially crafted

certificates.

Software Description:

- gnutls28: GNU TLS library

Details:

Bing Shi discovered that GnuTLS incorrectly handled decoding certain

DER-encoded certificates. A remote attacker could possibly use this issue

to cause GnuTLS to consume resources, leading to a denial of service.

Topics Covered

security advisory denial of service critical ubuntu gnutls resource consumption resource exhaustion

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
   libgnutls30t64                  3.8.6-2ubuntu1.1

Ubuntu 24.04 LTS
   libgnutls30t64                  3.8.3-1.1ubuntu3.3

Ubuntu 22.04 LTS
   libgnutls30                     3.7.3-4ubuntu1.6

Ubuntu 20.04 LTS
   libgnutls30                     3.6.13-2ubuntu1.12

In general, a standard system update will make all the necessary changes.