Bug 585268 (CVE-2016-4456, GNUTLS-SA-2016-1)

Summary:	=net-libs/gnutls-3.4.12: insecure getenv() on GNUTLS_KEYLOGFILE
Product:	Gentoo Security	Reporter:	Kristian Fiskerstrand (RETIRED) <k_f>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	alonbl, crypto+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://gnutls.org/security.html#GNUTLS-SA-2016-1
Whiteboard:	̃~2 [noglsa]
Package list:		Runtime testing required:	---

Description Kristian Fiskerstrand (RETIRED) gentoo-dev

2016-06-07 10:23:06 UTC

Tag	Other identifiers	Severity	Information
GNUTLS-SA-2016-1
	- 	File overwrite by setuid programs 	Setuid programs using GnuTLS 3.4.12 could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 and fixed in GnuTLS 3.4.13. Recommendation: Upgrade to GnuTLS 3.4.13, or later versions.

Comment 1 Alon Bar-Lev (RETIRED) gentoo-dev

2016-06-11 04:34:46 UTC

Already in tree, let's wait for a few days as build changes are not trivial.

Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev

2016-06-11 11:42:28 UTC

(In reply to Alon Bar-Lev from comment #1)
> Already in tree, let's wait for a few days as build changes are not trivial.

Thanks, since this does not affect stable, once affected version (3.4.12) is removed from tree you can close the bug.

Comment 3 Alon Bar-Lev (RETIRED) gentoo-dev

2016-06-11 11:53:43 UTC

OK, I cleaned up all unstable packages.