| Summary: | gnutls new security issue CVE-2012-1573 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, sysadmin-bugs, tmb |
| Version: | 1 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Source RPM: | gnutls-2.10.5-2.1.mga1.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2012-03-27 22:03:49 CEST
Patched package uploaded. Advisory: ======================== Updated gnutls packages fix security vulnerability: gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure (CVE-2012-1573). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:040 ======================== Updated packages in core/updates_testing: ======================== gnutls-2.10.5-2.2.mga1 libgnutls26-2.10.5-2.2.mga1 libgnutls-devel-2.10.5-2.2.mga1 from gnutls-2.10.5-2.2.mga1.src.rpm Assignee:
bugsquad =>
qa-bugs I'm trying to test with test case 2 from http://wiki.mandriva.com/en/Testing:Gnutls but I'm getting ... gnutls-cli -p 143 localhost -s Resolving 'localhost'... Connecting to '127.0.0.1:143'... - Simple Client Mode: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. STARTTLS STARTTLS BAD Error in IMAP command received by server. Suggestions? CC:
(none) =>
davidwhodgins Because you didn't put the dot first. Don't worry, I did the same thing at first. [david@marin ~]$ gnutls-cli -p 143 localhost -s Resolving 'localhost'... Connecting to '127.0.0.1:143'... - Simple Client Mode: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. STARTTLS STARTTLS BAD Error in IMAP command received by server. . STARTTLS . OK Begin TLS negotiation now. Lol. Thanks. Works much better with it. :-) Testing complete on i586 for the srpm gnutls-2.10.5-2.2.mga1.src.rpm Ping. We still need x86-64 bit testing for this security update. Testing complete using my mail provider. Suggested Advisory: ------------- Updated gnutls packages fix security vulnerability: gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure (CVE-2012-1573). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:040 https://bugs.mageia.org/show_bug.cgi?id=5139 ------------- SRPM: gnutls-2.10.5-2.2.mga1.src.rpm Could sysadmin please push from core/updates_testing to core/updates Thankyou! Keywords:
(none) =>
validated_update Update pushed Status:
NEW =>
RESOLVED |