Mandriva has issued this advisory today (March 27): http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:040 Cauldron is not vulnerable (it has 3.0.17).
Patched package uploaded. Advisory: ======================== Updated gnutls packages fix security vulnerability: gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure (CVE-2012-1573). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:040 ======================== Updated packages in core/updates_testing: ======================== gnutls-2.10.5-2.2.mga1 libgnutls26-2.10.5-2.2.mga1 libgnutls-devel-2.10.5-2.2.mga1 from gnutls-2.10.5-2.2.mga1.src.rpm
Assignee: bugsquad => qa-bugs
I'm trying to test with test case 2 from http://wiki.mandriva.com/en/Testing:Gnutls but I'm getting ... gnutls-cli -p 143 localhost -s Resolving 'localhost'... Connecting to '127.0.0.1:143'... - Simple Client Mode: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. STARTTLS STARTTLS BAD Error in IMAP command received by server. Suggestions?
CC: (none) => davidwhodgins
Because you didn't put the dot first. Don't worry, I did the same thing at first. [david@marin ~]$ gnutls-cli -p 143 localhost -s Resolving 'localhost'... Connecting to '127.0.0.1:143'... - Simple Client Mode: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. STARTTLS STARTTLS BAD Error in IMAP command received by server. . STARTTLS . OK Begin TLS negotiation now.
Lol. Thanks. Works much better with it. :-) Testing complete on i586 for the srpm gnutls-2.10.5-2.2.mga1.src.rpm
Ping. We still need x86-64 bit testing for this security update.
Testing complete using my mail provider. Suggested Advisory: ------------- Updated gnutls packages fix security vulnerability: gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure (CVE-2012-1573). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:040 https://bugs.mageia.org/show_bug.cgi?id=5139 ------------- SRPM: gnutls-2.10.5-2.2.mga1.src.rpm Could sysadmin please push from core/updates_testing to core/updates Thankyou!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Update pushed
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED