Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 715602 (CVE-2020-11501, GNUTLS-SA-2020-03-31) - <net-libs/gnutls-3.6.13: DTLS-protocol regression - client would not contribute any randomness to the DTLS negotiation (CVE-2020-11501/GNUTLS-SA-2020-03-31)
Summary: <net-libs/gnutls-3.6.13: DTLS-protocol regression - client would not contribu...
Status: RESOLVED FIXED
Alias: CVE-2020-11501, GNUTLS-SA-2020-03-31
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://www.gnutls.org/security-new.h...
Whiteboard: A3 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-03-31 11:25 UTC by Lars Wendler (Polynomial-C) (RETIRED)
Modified: 2020-04-16 21:48 UTC (History)
1 user (show)

See Also:
Package list:
net-libs/gnutls-3.6.13
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2020-03-31 11:25:04 UTC 
Quote from upstream's security advisory:

It was found that GnuTLS 3.6.3 introduced a regression in the DTLS protocol implementation. This caused the DTLS client to not contribute any randomness to the DTLS negotiation breaking the security guarantees of the DTLS protocol.

Recommendation: To address the issue found upgrade to GnuTLS 3.6.13 or later versions.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-31 11:29:30 UTC 
@maintainer(s), please create an appropriate ebuild.
Comment 2 Larry the Git Cow gentoo-dev 2020-03-31 11:29:51 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d9197424c42d02f8d2b330ac3cc08bedd54a0235

commit d9197424c42d02f8d2b330ac3cc08bedd54a0235
Author:     Lars Wendler <polynomial-c@gentoo.org>
AuthorDate: 2020-03-31 11:28:55 +0000
Commit:     Lars Wendler <polynomial-c@gentoo.org>
CommitDate: 2020-03-31 11:28:55 +0000

    net-libs/gnutls: Security bump to version 3.6.13
    
    Bug: https://bugs.gentoo.org/715602
    Package-Manager: Portage-2.3.96, Repoman-2.3.22
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>

 net-libs/gnutls/Manifest             |   1 +
 net-libs/gnutls/gnutls-3.6.13.ebuild | 132 +++++++++++++++++++++++++++++++++++
 2 files changed, 133 insertions(+)
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-31 11:31:30 UTC 
@maintainer(s), this isn't a great vulnerability at all, so are we alright to stabilise now? 

Thanks for super quick bump and report by the way.
Comment 4 Agostino Sarubbo gentoo-dev 2020-03-31 12:37:30 UTC 
ia64 will pass. See https://archives.gentoo.org/gentoo-dev/message/edaadc85d7423810dd6ecfeda29cc85f
Comment 5 Agostino Sarubbo gentoo-dev 2020-04-01 08:35:00 UTC 
arm stable
Comment 6 Agostino Sarubbo gentoo-dev 2020-04-01 08:36:32 UTC 
x86 stable
Comment 7 Mart Raudsepp gentoo-dev 2020-04-01 12:57:45 UTC 
arm64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2020-04-02 08:19:54 UTC 
amd64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2020-04-02 08:20:24 UTC 
ppc stable
Comment 10 Agostino Sarubbo gentoo-dev 2020-04-02 08:20:51 UTC 
ppc64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2020-04-02 08:21:20 UTC 
sparc stable
Comment 12 Larry the Git Cow gentoo-dev 2020-04-02 21:54:50 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b3c033cf9fc2695e35c44f837a0fc0b477cf30cf

commit b3c033cf9fc2695e35c44f837a0fc0b477cf30cf
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-04-02 21:54:33 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-04-02 21:54:43 +0000

    net-libs/gnutls: security cleanup
    
    Bug: https://bugs.gentoo.org/715602
    Package-Manager: Portage-2.3.96, Repoman-2.3.22
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 net-libs/gnutls/Manifest               |   2 -
 net-libs/gnutls/gnutls-3.6.12.ebuild   | 132 ---------------------------------
 net-libs/gnutls/gnutls-3.6.7-r1.ebuild | 129 --------------------------------
 3 files changed, 263 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=de14163ee0d91a87d8b097835f640a05d5d7d76c

commit de14163ee0d91a87d8b097835f640a05d5d7d76c
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2020-04-02 21:53:04 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-04-02 21:54:42 +0000

    net-libs/gnutls: mark ia64, hppa & s390 stable (bug #715602)
    
    Bug: https://bugs.gentoo.org/715602
    Package-Manager: Portage-2.3.96, Repoman-2.3.22
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 net-libs/gnutls/gnutls-3.6.13.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 13 Thomas Deutschmann (RETIRED) gentoo-dev 2020-04-02 21:55:22 UTC 
New GLSA request filed.
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2020-04-02 23:05:01 UTC 
This issue was resolved and addressed in
 GLSA 202004-06 at https://security.gentoo.org/glsa/202004-06
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 15 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-03 01:02:47 UTC 
Upstream bug: https://gitlab.com/gnutls/gnutls/-/issues/960

Still awaiting CVE.
Comment 16 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-16 21:48:13 UTC 
Tree is clean.