Ola Lundqvist pushed to branch master at Debian Security Tracker / security-tracker
Commits: 9082b3be by Ola Lundqvist at 2018-08-30T20:16:15Z Add more information about the gnutls vulnerabilities. - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -13515,15 +13515,21 @@ CVE-2018-10846 (A cache-based side channel in GnuTLS implementation that leads t - gnutls28 <unfixed> - gnutls26 <removed> NOTE: https://gitlab.com/gnutls/gnutls/merge_requests/657 + NOTE: The proposed fix is to introduce a new option to force encrypt-then-mac instead of correcting the issue. NOTE: https://eprint.iacr.org/2018/747 CVE-2018-10845 (It was found that the GnuTLS implementation of HMAC-SHA-384 was ...) - gnutls28 <unfixed> - gnutls26 <removed> + NOTE: https://gitlab.com/gnutls/gnutls/issues/455 + NOTE: Correctly account length field https://gitlab.com/gnutls/gnutls/commit/cc14ec5ece856cb083d64e6a5a8657323da661cb NOTE: https://gitlab.com/gnutls/gnutls/merge_requests/657 NOTE: https://eprint.iacr.org/2018/747 CVE-2018-10844 (It was found that the GnuTLS implementation of HMAC-SHA-256 was ...) - gnutls28 <unfixed> - gnutls26 <removed> + NOTE: https://gitlab.com/gnutls/gnutls/issues/456 + NOTE: Remove from defaults https://gitlab.com/gnutls/gnutls/commit/29ffa2a1fa4cc396c5d1563a3e5cdca0174de28b + NOTE: https://gitlab.com/gnutls/gnutls/commit/c32a8690f9f9b05994078fe9d2e7a41b18da5b09 NOTE: https://gitlab.com/gnutls/gnutls/merge_requests/657 NOTE: https://eprint.iacr.org/2018/747 CVE-2018-10843 (source-to-image component of Openshift Container Platform before ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/9082b3bed2f4689e4c7204178cfbb84f71ff4da6 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/9082b3bed2f4689e4c7204178cfbb84f71ff4da6 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits