[ GLSA 202006-01 ] GnuTLS

[GLSA]

Gentoo Linux Security Advisory

Title: GnuTLS: Information disclosure (GLSA 202006-01)
Severity: normal
Exploitable: remote
Date: 2020-06-09
Bug(s): #727108
ID: 202006-01

Synopsis

An information disclosure vulnerability in GnuTLS allow remote
attackers to obtain sensitive information.


Background

GnuTLS is an Open Source implementation of the TLS and SSL protocols.

Affected Packages

Package: net-libs/gnutls
Vulnerable: < 3.6.14
Unaffected: >= 3.6.14
Architectures: All supported architectures


Description

A flaw was reported in the TLS session ticket key construction in
GnuTLS.


Impact

A remote attacker could recover previous conversations in TLS 1.2 and
obtain sensitive information or conduct a man-in-the-middle attack to
bypass authentication in TLS 1.3.


Workaround

There is no known workaround at this time.

Resolution

All GnuTLS user should upgrade to the latest version: