Advisories » MGASA-2020-0379

Updated gnutls packages fix security vulnerability

Publication date: 30 Sep 2020
Modification date: 30 Sep 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2020-24659

Description

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL
pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent
with unexpected timing, and then an invalid second handshake occurs. The crash
happens in the application's error handling path, where the gnutls_deinit
function is called after detecting a handshake failure (CVE-2020-24659).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=27257
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-09-04
• https://lists.gnupg.org/pipermail/gnutls-help/2020-September/004669.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24659

SRPMS

7/core

• gnutls-3.6.15-1.mga7