Description: "GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application."
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1153fd1d6db7911170bfadb36d09d25c5f946122 commit 1153fd1d6db7911170bfadb36d09d25c5f946122 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-06-04 12:07:02 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-06-04 13:12:00 +0000 net-libs/gnutls: bump to v3.6.14 Bug: https://bugs.gentoo.org/727108 Package-Manager: Portage-2.3.100, Repoman-2.3.22 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> net-libs/gnutls/Manifest | 1 + net-libs/gnutls/gnutls-3.6.14.ebuild | 132 +++++++++++++++++++++++++++++++++++ 2 files changed, 133 insertions(+)
amd64 stable
arm stable
ppc stable
ppc64 stable
sparc stable
x86 stable
arm64 stable
s390 stable
hppa stable
@maintainer(s), please cleanup
This issue was resolved and addressed in GLSA 202006-01 at https://security.gentoo.org/glsa/202006-01 by GLSA coordinator Thomas Deutschmann (whissi).
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4254290cbaff26d7530a273eb9d307317f7f5f45 commit 4254290cbaff26d7530a273eb9d307317f7f5f45 Author: Thomas Deutschmann <whissi@gentoo.org> AuthorDate: 2020-06-09 14:58:22 +0000 Commit: Thomas Deutschmann <whissi@gentoo.org> CommitDate: 2020-06-09 14:58:22 +0000 net-libs/gnutls: security cleanup Bug: https://bugs.gentoo.org/727108 Package-Manager: Portage-2.3.100, Repoman-2.3.22 Signed-off-by: Thomas Deutschmann <whissi@gentoo.org> net-libs/gnutls/Manifest | 1 - ...s-3.6.13-handle-expired-root-certificates.patch | 391 --------------------- net-libs/gnutls/gnutls-3.6.13-r1.ebuild | 134 ------- 3 files changed, 526 deletions(-)
