| Summary: | gnutls new security issue CVE-2019-3829 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, herman.viaene, marja11, nicolas.salguero, smelror, sysadmin-bugs |
| Version: | 6 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA6-32-OK MGA6-64-OK | ||
| Source RPM: | gnutls-3.5.13-1.2.mga6.src.rpm | CVE: | CVE-2019-3829 |
| Status comment: | |||
|
Description
David Walser
2019-03-29 13:49:44 CET
Assigning to all packagers collectively, since there is no registered maintainer for this package. Assignee:
bugsquad =>
pkg-bugs Fedora has issued an advisory for this today (March 31): https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WRSOL66LHP4SD3Y2ECJDOGT4K663ECDU/ Suggested advisory: ======================== The updated packages fix a security vulnerability: A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected. (CVE-2019-3829) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3829 https://www.gnutls.org/security-new.html https://gitlab.com/gnutls/gnutls/issues/694 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WRSOL66LHP4SD3Y2ECJDOGT4K663ECDU/ ======================== Updated packages in core/updates_testing: ======================== gnutls-3.5.13-1.3.mga6 lib(64)gnutls30-3.5.13-1.3.mga6 lib(64)gnutlsxx28-3.5.13-1.3.mga6 lib(64)gnutls-devel-3.5.13-1.3.mga6 from SRPMS: gnutls-3.5.13-1.3.mga6.src.rpm Assignee:
pkg-bugs =>
qa-bugs MGA6-32 MATE on IBM Thinkpad R50e No installation issues. Ref to bug 23682 Comment 4 : I installed xombrero, point it to google, enter "apod" in the search field and select the astronomical picture of the day. Looks OK. Whiteboard:
(none) =>
MGA6-32-OK MGA6-64 Plasma on AMD/nvidia-based system Performed the same tests as Herman, because they again sounded really easy. Looked at several Pictures of the Day, and all looked nice. No issues. This one looks good. Validating. Suggested advisory in Comment 3. Whiteboard:
MGA6-32-OK =>
MGA6-32-OK MGA6-64-OK
Dave Hodgins
2019-04-04 15:05:02 CEST
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2019-0134.html Resolution:
(none) =>
FIXED |