Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 598
Alerts This Week
Warning Icon 1 598

Stay Secure with the Latest Linux Advisories

Opensuse Large Esm H800
openSUSE

openSUSE Python311 Important Memory Error Command Injection Fix 2026-3132-1

Calendar White Jul 20, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE gstreamer-plugins-bad Important Buffer Overflow Risk 2026-3133-1

Calendar White Jul 20, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE 389-ds Important Heap Overflow DoS Issues Vuln 2026-3136-1

Calendar White Jul 20, 2026
Important
Opensuse Large Esm H800
openSUSE

openSUSE 389-ds Important Heap Overflow DoS Fix 2026-3137-1

Calendar White Jul 20, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 8573-1 Libde265 Critical Denial of Service Vulnerabilities

Calendar White Jul 20, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu 26.04 Wget Important Server-Side Request Forgery Vuln USN-8572-1

Calendar White Jul 20, 2026
Important
Ubuntu Large Esm H800
Ubuntu

Ubuntu Apache2 Important DoS HTTP Response Issues USN-8571-1

Calendar White Jul 20, 2026
Important
Rockylinux Esm H900
Rocky

Rocky Linux javapackages-tools Important Directory Traversal CVE-2025-67030

Calendar White Jul 20, 2026
Important
Rockylinux Esm H900
Rocky

Rocky Linux nodejs Important Denial of Service Update RLSA-2026-41947

Calendar White Jul 20, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":0,"type":"x","order":4,"pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 7 articles for you...
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorydebianDoS

Debian 11: DLA-3980-1 critical: python3.9 multiple flaws addressed

Multiple vulnerabilities have been fixed in the Python3 interpreter. CVE-2015-20107 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3980-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Adrian Bunk December 02, 2024 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : python3.9 Version : 3.9.2-1+deb11u2 CVE ID : CVE-2015-20107 CVE-2020-10735 CVE-2021-3426 CVE-2021-3733 CVE-2021-3737 CVE-2021-4189 CVE-2021-28861 CVE-2021-29921 CVE-2022-42919 CVE-2022-45061 CVE-2023-6597 CVE-2023-24329 CVE-2023-27043 CVE-2023-40217 CVE-2024-0397 CVE-2024-0450 CVE-2024-4032 CVE-2024-6232 CVE-2024-6923 CVE-2024-7592 CVE-2024-8088 CVE-2024-9287 CVE-2024-11168 Debian Bug : 989195 1070135 1059298 1070133 Multiple vulnerabilities have been fixed in the Python3 interpreter. CVE-2015-20107 The mailcap module did not add escape characters into commands discovered in the system mailcap file CVE-2020-10735 Prevent DoS with very large int CVE-2021-3426 Remove the pydoc getfile feature which could be abused to read arbitrary files on the disk CVE-2021-3733 Regular Expression Denial of Service in urllib's AbstractBasicAuthHandler class CVE-2021-3737 Infinite loop in the HTTP client code CVE-2021-4189 Make ftplib not trust the PASV response CVE-2021-28861 Open redirection vulnerability in http.server CVE-2021-29921 Leading zeros in IPv4 addresses are no longer tolerated CVE-2022-42919 Don't use Linux abstract sockets for multiprocessing CVE-2022-45061 Quadratic time in the IDNA decoder CVE-2023-6597 tempfile.TemporaryDirectory failure to remove dir CVE-2023-24329 Strip C0 control and space chars in urlsplit CVE-2023-27043 Reject malformedaddresses in email.parseaddr() CVE-2023-40217 ssl.SSLSocket bypass of the TLS handshake CVE-2024-0397 Race condition in ssl.SSLContext CVE-2024-0450 Quoted-overlap zipbomb DoS CVE-2024-4032 Incorrect information about private addresses in the ipaddress module CVE-2024-6232 ReDoS when parsing tarfile headers CVE-2024-6923 Encode newlines in headers in the email module CVE-2024-7592 Quadratic complexity parsing cookies with backslashes CVE-2024-8088 Infinite loop when iterating over zip archive entry names CVE-2024-9287 venv activation scripts did't quote paths CVE-2024-11168 urllib functions improperly validated bracketed hosts For Debian 11 bullseye, these problems have been fixed in version 3.9.2-1+deb11u2. We recommend that you upgrade your python3.9 packages. For the detailed security status of python3.9 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/python3.9 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Ubuntu LTS USN-4100-1 fixes various vulnerabilities in the PHP interpreter, tackling buffer overflow and denial of service concerns.. Python Update, Debian Security, DoS Prevention, Input Validation Fixes. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Dec 02, 2024 •Critical Debian LTS
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisorymoderatepython

Mageia 9: 2024-0317 moderate: Python memory race, email header injection

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a . MGASA-2024-0317 - Updated python3 packages fix security vulnerabilities Publication date: 27 Sep 2024 URL: https://advisories.mageia.org/MGASA-2024-0317.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-0397, CVE-2024-4032, CVE-2024-6923, CVE-2024-8088, CVE-2024-6232, CVE-2024-7592, CVE-2015-2104, CVE-2023-27043 A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. (CVE-2024-0397) The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. (CVE-2024-4032) The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. (CVE-2024-6923) When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defectapplies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected. (CVE-2024-8088) Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. (CVE-2024-6232) When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value. (CVE-2024-7592) Urlparse insufficient validation leads to open redirect. (CVE-2015-2104) The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043) References: - https://bugs.mageia.org/show_bug.cgi?id=33436 - https://www.openwall.com/lists/oss-security/2024/06/17/2 - https://www.openwall.com/lists/oss-security/2024/06/17/3 - - https://www.openwall.com/lists/oss-security/2024/08/01/3 - https://www.openwall.com/lists/oss-security/2024/08/22/1 - https://www.openwall.com/lists/oss-security/2024/09/03/5 - https://www.openwall.com/lists/oss-security/2024/09/07/3 - https://www.cve.org/CVERecord?id=CVE-2024-0397 - https://www.cve.org/CVERecord?id=CVE-2024-4032 - https://www.cve.org/CVERecord?id=CVE-2024-6923 - https://www.cve.org/CVERecord?id=CVE-2024-8088 - https://www.cve.org/CVERecord?id=CVE-2024-6232 - https://www.cve.org/CVERecord?id=CVE-2024-7592 - https://www.cve.org/CVERecord?id=CVE-2015-2104 - https://www.cve.org/CVERecord?id=CVE-2023-27043 SRPMS: - 9/core/python3-3.10.11-1.3.mga9 . Recentenhancements to python3 libraries address concerns related to memory concurrency and secure SSL context protocols for Mageia 9. Release date: 27 September 2024.. Python Security, Mageia Advisory, TLS Handshake Issues, Memory Race Condition, Email Serialization. . LinuxSecurity.com Team

Calendar%202 Sep 27, 2024 Mageia
Banner 3 1028x280 1708121785 1771599793
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorymoderatedebian

Debian 12: DSA-5759-1 Moderate: Python3.11 DoS And SSL Problems

Multiple security issues were discovered in Python, a high-level, interactive, object-oriented language: CVE-2024-0397 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5759-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff August 27, 2024 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : python3.11 CVE ID : CVE-2024-0397 CVE-2024-4032 CVE-2024-8088 Multiple security issues were discovered in Python, a high-level, interactive, object-oriented language: CVE-2024-0397 A race condition in the ssl module was found when accessing CA certificates. CVE-2024-4032 The ipaddress module contained incorrect information whether some ipv4 and ipv6 address ranges are designated as globally reachable or private. CVE-2024-8088 Incorrect handling of path names in the zipfile module could result in an infinite loop when processing a zip archive (resulting in denial of service) For the stable distribution (bookworm), these problems have been fixed in version 3.11.2-6+deb12u3. We recommend that you upgrade your python3.11 packages. For the detailed security status of python3.11 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/python3.11 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Several vulnerabilities found in Python 3.11 lead to race conditions, denial of service, and inaccurate data on memory addresses.. Debian Security, DoS Attacks, SSL Vulnerabilities, Python Security. . LinuxSecurity.com Team

Calendar%202 Aug 27, 2024 Debian
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorydenial of serviceubuntu

Ubuntu 16.04 ESM: USN-5168-4 Critical: NSS SSL Regression Fix

USN-5168-3 introduced a regression in NSS.. =========================================================================Ubuntu Security Notice USN-5168-4 December 07, 2021 nss regression ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: USN-5168-3 introduced a regression in NSS. Software Description: - nss: Network Security Service library Details: USN-5168-3 fixed a vulnerability in NSS. Unfortunately that update introduced a regression that could break SSL connections. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS signatures. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: libnss3 2:3.28.4-0ubuntu0.16.04.14+esm2 Ubuntu 14.04 ESM: libnss3 2:3.28.4-0ubuntu0.14.04.5+esm10 After a standard system update you need to restart any applications that use NSS, such as Evolution, to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5168-4 https://ubuntu.com/security/notices/USN-5168-1 CVE-2021-43527 . Ubuntu Security Notice USN-5171-3 addresses a vulnerability in OpenSSL impacting data encryption, further information provided.. NSS Regression, Ubuntu Security Notice, SSL Vulnerability. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Dec 07, 2021 •Critical Ubuntu
Banner 3 1028x280 1708121785 1771599793
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisorydenial of servicecritical issue

Mageia 7 MGASA-2021-0200 Critical: QSslSocket Denial of Service

QSslSocket incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962) This update provides additionals fixes: - Check that the sizes are even representable when checking if clipping is . MGASA-2021-0200 - Updated qtbase5 packages fix security vulnerability Publication date: 30 Apr 2021 URL: https://advisories.mageia.org/MGASA-2021-0200.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-13962 QSslSocket incorrectly calls SSL_shutdown() in OpenSSL mid-handshake causing denial of service in TLS applications (CVE-2020-13962) This update provides additionals fixes: - Check that the sizes are even representable when checking if clipping is necessary (P300) - Multiply instead of shifting, The shift operator is undefined for negative values. (P301) - Check returns of hex2int in get_hex_rgb, Avoids undefined behavior when trying to shift negative values. (P302) - Sanitize lengthValue in CSS parser, Limit the LengthData to the integer range before rounding it, taking into account that qRound() substracts 1 from negative values. (P303) - QBezier: Don't try calculating a unit vector when length is null. It's undefined and causes a division by zero. (P304) - Avoid potential ub in corrupt bmp file. biHeight may be int_min, in which case qAbs () will not work. (P305) - wasm: disable XDG_RUNTIME_DIR warning XDG is not very relevant on the Web platform. (P306) - Use SOURCE_DATE_EPOCH. Use the standard variable name in addition to the QT-specific one to make builds reproducible out-of-the-box (P308) - Fix notification of QDockWidget when it gets undocked (P309) - Synthesize Enter/LeaveEvent for accepted QTabletEvent (P310) - Fix crash when running QtCore: Stack is misaligned on x86-64 (P311) - Add support for PostgreSQL 12 (P312) - QStandardPaths: Correct handling for XDG_RUNTIME_DIR (P313) - QStandardPaths/Unix: improve the XDG_RUNTIME_DIR creation/detection (P312) - Add remote print queue support(P313) References: - https://bugs.mageia.org/show_bug.cgi?id=27218 - - https://access.redhat.com/errata/RHSA-2020:4690 - https://www.cve.org/CVERecord?id=CVE-2020-13962 SRPMS: - 7/core/qtbase5-5.12.6-4.2.mga7 . Revised qtbase5 bundles resolve a significant vulnerability in Mageia related to QSslSocket, leading to potential denial-of-service in TLS-enabled applications.. Mageia Security, QSslSocket, DoS Threat, SSL Update, QtBase5 Patch. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Apr 30, 2021 •Critical Mageia
99
Ls Advisories Slackware Esm H240
Price Tag%201security advisorycriticalslackware

Slackware 14.0/14.1: 2016-034-03 Severe SSLv2 Vulnerability Detected

New openssl packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] openssl (SSA:2016-034-03) New openssl packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/openssl-1.0.1r-i486-1_slack14.1.txz: Upgraded. This update fixes the following security issue: SSLv2 doesn't block disabled ciphers (CVE-2015-3197). For more information, see: https://openssl-library.org/news/secadv/20160128.txt https://www.cve.org/CVERecord?id=CVE-2015-3197 (* Security fix *) patches/packages/openssl-solibs-1.0.1r-i486-1_slack14.1.txz: Upgraded. +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated packages for Slackware 14.0: Updated packages for Slackware x86_64 14.0: Updated packages for Slackware 14.1: Updated packages for Slackware x86_64 14.1: Updated packages for Slackware -current: Updated packages for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 packages: 0d6e8d3b27326c84b9996ed189868eba openssl-1.0.1r-i486-1_slack14.0.txz e3cb0b75e9df4be9d8fd1cfcd2fbd306 openssl-solibs-1.0.1r-i486-1_slack14.0.txz Slackware x86_64 14.0 packages: 7b52f4a43b42703a6840945d55f503ee openssl-1.0.1r-x86_64-1_slack14.0.txz eee92cb549bacae21e63bee22b9bb8d4 openssl-solibs-1.0.1r-x86_64-1_slack14.0.txz Slackware 14.1 packages: 5be72ab551b2064aa34c83b42a07ff85 openssl-1.0.1r-i486-1_slack14.1.txz b28e00a7124822258cfd137ab5ce0572 openssl-solibs-1.0.1r-i486-1_slack14.1.txz Slackware x86_64 14.1 packages: 8e0273b1e99e8caa48fcab2547f051e9 openssl-1.0.1r-x86_64-1_slack14.1.txz 60f3994c35679455cab7a984493d1fdb openssl-solibs-1.0.1r-x86_64-1_slack14.1.txz Slackware -current packages: 509771b1f7d58a682feb2099fdf3eb5d a/openssl-solibs-1.0.2f-i586-1.txz d72c0188f4223d1dc2d6080f8d99d92e n/openssl-1.0.2f-i586-1.txz Slackware x86_64 -current packages: 0c6653d3c37271f9f1a58a8c0e1f7b40 a/openssl-solibs-1.0.2f-x86_64-1.txz e4ebd1204644ea58e1779187fe071428 n/openssl-1.0.2f-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the packages as root: # upgradepkg openssl-1.0.1r-i486-1_slack14.1.txz openssl-solibs-1.0.1r-i486-1_slack14.1.txz +-----+ . Freshly introduced openssl updates for Slackware to mitigate foundational security vulnerabilities, improving overall system reliability and safeguarding user data.. Slackware Update, OpenSSL Security, System Integrity, Security Fix. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Feb 04, 2016 •Important Slackware
Banner 3 1028x280 1708121785 1771599793
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorysecurity issueupdate

Debian: DSA-3191-1 Important: Flaws in GnuTLS SSL Protocol Security

Multiple vulnerabilities have been discovered in GnuTLS, a library implementing the TLS and SSL protocols. The Common Vulnerabilities and Exposures project identifies the following problems: . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3191-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Salvatore Bonaccorso March 15, 2015 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : gnutls26 CVE ID : CVE-2015-0282 CVE-2015-0294 Multiple vulnerabilities have been discovered in GnuTLS, a library implementing the TLS and SSL protocols. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-0282 GnuTLS does not verify the RSA PKCS #1 signature algorithm to match the signature algorithm in the certificate, leading to a potential downgrade to a disallowed algorithm without detecting it. CVE-2015-0294 It was reported that GnuTLS does not check whether the two signature algorithms match on certificate import. For the stable distribution (wheezy), these problems have been fixed in version 2.12.20-8+deb7u3. We recommend that you upgrade your gnutls26 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian security advisory DSA-3192-1 releases updates for openssl to address various encryption vulnerabilities.. GnuTLS Security Update, Debian Advisory, TLS Algorithm Check. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 15, 2015 •Important Debian
98
Ls Advisories Redhat Esm H240
Price Tag%201security advisoryred hatimportant

RHEL 5: RHSA-2014:0247-01 Critical gnutls SSL Vulnerabilities Advisory

Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: gnutls security update Advisory ID: RHSA-2014:0247-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2014:0247.html Issue date: 2014-03-03 CVE Names: CVE-2009-5138 CVE-2014-0092 ==================================================================== 1. Summary: Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092) A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid.(CVE-2009-5138) The CVE-2014-0092 issue was discovered by Nikos Mavrogiannopoulos of the Red Hat Security Technologies Team. Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS library must be restarted. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1069301 - CVE-2009-5138 gnutls: incorrect handling of V1 intermediate certificates 1069865 - CVE-2014-0092 gnutls: incorrect error handling in certificate verification (GNUTLS-SA-2014-2) 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: gnutls-1.4.1-14.el5_10.i386.rpm gnutls-debuginfo-1.4.1-14.el5_10.i386.rpm gnutls-utils-1.4.1-14.el5_10.i386.rpm x86_64: gnutls-1.4.1-14.el5_10.i386.rpm gnutls-1.4.1-14.el5_10.x86_64.rpm gnutls-debuginfo-1.4.1-14.el5_10.i386.rpm gnutls-debuginfo-1.4.1-14.el5_10.x86_64.rpm gnutls-utils-1.4.1-14.el5_10.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: i386: gnutls-debuginfo-1.4.1-14.el5_10.i386.rpm gnutls-devel-1.4.1-14.el5_10.i386.rpm x86_64: gnutls-debuginfo-1.4.1-14.el5_10.i386.rpm gnutls-debuginfo-1.4.1-14.el5_10.x86_64.rpm gnutls-devel-1.4.1-14.el5_10.i386.rpm gnutls-devel-1.4.1-14.el5_10.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: gnutls-1.4.1-14.el5_10.i386.rpm gnutls-debuginfo-1.4.1-14.el5_10.i386.rpm gnutls-devel-1.4.1-14.el5_10.i386.rpm gnutls-utils-1.4.1-14.el5_10.i386.rpm ia64: gnutls-1.4.1-14.el5_10.i386.rpm gnutls-1.4.1-14.el5_10.ia64.rpm gnutls-debuginfo-1.4.1-14.el5_10.i386.rpm gnutls-debuginfo-1.4.1-14.el5_10.ia64.rpm gnutls-devel-1.4.1-14.el5_10.ia64.rpm gnutls-utils-1.4.1-14.el5_10.ia64.rpm ppc: gnutls-1.4.1-14.el5_10.ppc.rpm gnutls-1.4.1-14.el5_10.ppc64.rpm gnutls-debuginfo-1.4.1-14.el5_10.ppc.rpm gnutls-debuginfo-1.4.1-14.el5_10.ppc64.rpm gnutls-devel-1.4.1-14.el5_10.ppc.rpm gnutls-devel-1.4.1-14.el5_10.ppc64.rpm gnutls-utils-1.4.1-14.el5_10.ppc.rpm s390x: gnutls-1.4.1-14.el5_10.s390.rpm gnutls-1.4.1-14.el5_10.s390x.rpm gnutls-debuginfo-1.4.1-14.el5_10.s390.rpm gnutls-debuginfo-1.4.1-14.el5_10.s390x.rpm gnutls-devel-1.4.1-14.el5_10.s390.rpm gnutls-devel-1.4.1-14.el5_10.s390x.rpm gnutls-utils-1.4.1-14.el5_10.s390x.rpm x86_64: gnutls-1.4.1-14.el5_10.i386.rpm gnutls-1.4.1-14.el5_10.x86_64.rpm gnutls-debuginfo-1.4.1-14.el5_10.i386.rpm gnutls-debuginfo-1.4.1-14.el5_10.x86_64.rpm gnutls-devel-1.4.1-14.el5_10.i386.rpm gnutls-devel-1.4.1-14.el5_10.x86_64.rpm gnutls-utils-1.4.1-14.el5_10.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2009-5138 https://access.redhat.com/security/cve/CVE-2014-0092 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. . Critical GnuTLS security patch information for Red Hat Enterprise Linux, aiming to resolve various vulnerabilities and implement essential corrections.. gnutls update, RHEL gnutls patch, Red Hat response. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 03, 2014 •Important Red Hat
Banner 3 1028x280 1708121785 1771599793
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":0,"type":"x","order":4,"pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics