Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 585268 (CVE-2016-4456, GNUTLS-SA-2016-1) - =net-libs/gnutls-3.4.12: insecure getenv() on GNUTLS_KEYLOGFILE
Summary: =net-libs/gnutls-3.4.12: insecure getenv() on GNUTLS_KEYLOGFILE
Status: RESOLVED FIXED
Alias: CVE-2016-4456, GNUTLS-SA-2016-1
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://gnutls.org/security.html#GNUTL...
Whiteboard: ̃~2 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-07 10:23 UTC by Kristian Fiskerstrand (RETIRED)
Modified: 2016-06-11 12:00 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2016-06-07 10:23:06 UTC 
Tag	Other identifiers	Severity	Information
GNUTLS-SA-2016-1
	- 	File overwrite by setuid programs 	Setuid programs using GnuTLS 3.4.12 could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 and fixed in GnuTLS 3.4.13. Recommendation: Upgrade to GnuTLS 3.4.13, or later versions.
Comment 1 Alon Bar-Lev (RETIRED) gentoo-dev 2016-06-11 04:34:46 UTC 
Already in tree, let's wait for a few days as build changes are not trivial.
Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev 2016-06-11 11:42:28 UTC 
(In reply to Alon Bar-Lev from comment #1)
> Already in tree, let's wait for a few days as build changes are not trivial.

Thanks, since this does not affect stable, once affected version (3.4.12) is removed from tree you can close the bug.
Comment 3 Alon Bar-Lev (RETIRED) gentoo-dev 2016-06-11 11:53:43 UTC 
OK, I cleaned up all unstable packages.