Bug 31558

Summary: gnutls new security issue CVE-2023-0361
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: major    
Priority: Normal CC: andrewsfarm, davidwhodgins, geiger.david68210, herman.viaene, sysadmin-bugs, tomhiddleston23c, zetisonapi
Version: 8Keywords: advisory, validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: MGA8-64-OK
Source RPM: gnutls-3.7.8-2.mga9.src.rpm CVE:
Status comment:

Description David Walser 2023-02-15 17:44:10 CET 
Debian has issued an advisory on February 14:
https://www.debian.org/security/2023/dsa-5349

The issue is fixed upstream in 3.8.0:
https://gnutls.org/security-new.html#GNUTLS-SA-2020-07-14

Mageia 8 is also affected.
David Walser 2023-02-15 17:44:20 CET

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 3.8.0

Comment 1 Lewis Smith 2023-02-15 21:09:37 CET 
This pkg has various maintainers, so assigning this update globally.

Assignee: bugsquad => pkg-bugs

Comment 2 David Walser 2023-02-19 17:02:30 CET 
Debian-LTS has issued an advisory for this on February 18:
https://www.debian.org/lts/security/2023/dla-3321
Comment 3 David GEIGER 2023-02-19 18:08:01 CET 
Done for both mga8 and Cauldron!

CC: (none) => geiger.david68210

Comment 4 David Walser 2023-02-19 21:31:26 CET 
Cauldron updated to 3.8.0 and Mageia 8 patched.  Thanks!

libgnutls30-3.6.15-3.4.mga8
gnutls-3.6.15-3.4.mga8
libgnutls-devel-3.6.15-3.4.mga8
libgnutlsxx28-3.6.15-3.4.mga8

from gnutls-3.6.15-3.4.mga8.src.rpm

Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8
Assignee: pkg-bugs => qa-bugs
Status comment: Fixed upstream in 3.8.0 => (none)

Comment 5 Herman Viaene 2023-02-21 10:46:31 CET 
MGA8-64 MATE on Acer Aspire 5253
No installation issues.
Ref bug 29021 Comment 4
$ gnutls-cli mach1
Processed 140 CA certificate(s).
Resolving 'mach1:443'...
Connecting to '192.168.2.1:443'...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
 - subject `EMAIL=root@localhost,OU=default httpd cert for localhost,CN=localhost', issuer `EMAIL=root@localhost,OU=default httpd cert for localhost,CN=localhost', serial 0x2b26b631453768c44ab1a432961d780848570faf, RSA key 2048 bits, signed using RSA-SHA256, activated `2021-04-06 11:45:22 UTC', expires `2022-04-06 11:45:22 UTC', pin-sha256="pvMLJ62KvViacXZFR/MDuWiWbWIvZhmbUIkRWjW08nA="
	Public Key ID:
		sha1:0a76055c20ef7bac21648d9fe12caa4928c82799
		sha256:a6f30b27ad8abd589a71764547f303b968966d622f66199b5089115a35b4f270
	Public Key PIN:
		pin-sha256:pvMLJ62KvViacXZFR/MDuWiWbWIvZhmbUIkRWjW08nA=

- Status: The certificate is NOT trusted. The certificate issuer is unknown. The certificate chain uses expired certificate. The name in the certificate does not match the expected. 
*** PKI verification of server certificate failed...
*** Fatal error: Error in the certificate.

$ gnutls-serv
Warning: no private key and certificate pairs were set.
HTTP Server listening on IPv4 0.0.0.0 port 5556...done
HTTP Server listening on IPv6 :: port 5556...done
pointing the browser to http://localhost:5556/ and got some binary data as an answer.
at the CLI got this feedback:
* Accepted connection from IPv4 127.0.0.1 port 48666 on Tue Feb 21 10:40:56 202
|<0x1839b00>| Received record packet of unknown type 71
Error in handshake: An unexpected TLS packet was received.

* Accepted connection from IPv4 127.0.0.1 port 48674 on Tue Feb 21 10:40:56 202
|<0x1839b00>| Received record packet of unknown type 71
Error in handshake: An unexpected TLS packet was received.

All inline with refered previous bug, so OK.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA8-64-OK

Comment 6 Thomas Andrews 2023-02-21 16:37:36 CET 
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2023-02-25 20:03:42 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 7 Mageia Robot 2023-02-27 21:29:12 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0067.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 8 David Walser 2023-05-20 01:29:33 CEST 
This update never actually got pushed.

Status: RESOLVED => REOPENED
Resolution: FIXED => (none)

Comment 9 Dave Hodgins 2023-05-23 07:28:22 CEST 
Fixed.

Resolution: (none) => FIXED
Status: REOPENED => RESOLVED

Comment 10 zetisno zetisno 2023-11-03 09:12:20 CET Comment hidden (spam)

CC: (none) => zetisonapi

Comment 11 tom hiddleston 2023-12-19 01:50:33 CET Comment hidden (spam)

CC: (none) => tomhiddleston23c