[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <8e3602af-836a-d812-91ed-d78d7ed2a150@suse.com>
Date: Tue, 10 Jan 2017 15:56:57 +0100
From: Andreas Stieger <astieger@...e.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1,
GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8
Hello,
GnuTLS 3.3.26 and 3.5.8 were released, with the following:
https://gnutls.org/security.html#GNUTLS-SA-2017-1
It was found using the OSS-FUZZ fuzzer infrastructure that decoding a
specially crafted X.509 certificate with Proxy Certificate Information
extension present could lead to a double free. This issue was fixed in
GnuTLS 3.3.26 and 3.5.8.
https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b
https://gnutls.org/security.html#GNUTLS-SA-2017-2
It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead to heap and stack overflows.
The support of OpenPGP certificates in GnuTLS is considered obsolete. As
such, it is not recommended to use OpenPGP certificates with GnuTLS.
https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a
https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732
https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a
Could CVEs please be assigned for these issues?
Thanks,
Andreas
--
Andreas Stieger <astieger@...e.com>
Project Manager Security
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton,
HRB 21284 (AG Nürnberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
