blob: 538cbd75da3c3b9717f05386daf68767aef3aac8 [file] [log] [blame]
<?xml version="1.0" encoding="UTF-8"?>
<glsa id="201110-05">
<title>GnuTLS: Multiple vulnerabilities</title>
<synopsis>Multiple vulnerabilities were found in GnuTLS, allowing for easier
man-in-the-middle attacks.
<product type="ebuild">gnutls</product>
<announced>October 10, 2011</announced>
<revised>October 10, 2011: 1</revised>
<package name="net-libs/gnutls" auto="yes" arch="*">
<unaffected range="ge">2.10.0</unaffected>
<vulnerable range="lt">2.10.0</vulnerable>
<p>GnuTLS is an Open Source implementation of the TLS 1.2 and SSL 3.0
<p>Multiple vulnerabilities have been discovered in GnuTLS. Please review
the CVE identifiers referenced below for details.
<impact type="normal">
<p>An attacker could perform man-in-the-middle attacks to spoof arbitrary
SSL servers via a crafted certificate issued by a legitimate
Certification Authority or to inject an arbitrary amount of chosen
plaintext into the beginning of the application protocol stream, allowing
for further exploitation.
<p>There is no known workaround at this time.</p>
<p>All GnuTLS users should upgrade to the latest version:</p>
# emerge --sync
# emerge --ask --oneshot --verbose "&gt;=net-libs/gnutls-2.10.0"
<p>NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since August 6, 2010. It is likely that your system is already
no longer affected by this issue.
<uri link="">CVE-2009-2730</uri>
<uri link="">CVE-2009-3555</uri>
<metadata timestamp="Fri, 07 Oct 2011 23:38:18 +0000" tag="requester">
<metadata timestamp="Mon, 10 Oct 2011 20:33:39 +0000" tag="submitter">