Bug 929690

Summary:	VUL-1: gnutls: ServerKeyExchange signature issue (GNUTLS-SA-2015-2) (SLOTH)
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Andreas Stieger <astieger>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P4 - Low	CC:	astieger, meissner, vcizek
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	960996

Description Andreas Stieger 2015-05-05 12:57:23 UTC

From http://www.gnutls.org/security.html#GNUTLS-SA-2015-2

Karthikeyan Bhargavan reported that a ServerKeyExchange signature sent by the server is not verified to be in the acceptable by the client set of algorithms. That has the effect of allowing MD5 signatures (which are disabled by default) in the ServerKeyExchange message. It is not believed that this bug can be exploited because a fraudulent signature has to be generated in real-time which is not known to be possible. However, since attacks can only get better it is recommended to update to a GnuTLS version which addresses the issue.
Recommendation: Upgrade to GnuTLS 3.4.1, or 3.3.15.

CVE request: http://seclists.org/oss-sec/2015/q2/367


Details: 
https://lists.gnupg.org/pipermail/gnutls-devel/2015-April/007572.html
https://bugzilla.redhat.com/show_bug.cgi?id=1218426

https://lists.gnupg.org/pipermail/gnutls-devel/2015-May/007577.html
https://lists.gnupg.org/pipermail/gnutls-devel/2015-May/007578.html

Upstream commit:
https://gitlab.com/gnutls/gnutls/commit/7d9d5c61f8445dc9e9ca47bb575c77cef17da17a

Testcase:
https://gitlab.com/gnutls/gnutls/commit/6822a37947d4e38c45b1afc0121cda35ba897182

Comment 1 Bernhard Wiedemann 2015-05-05 16:00:11 UTC

This is an autogenerated message for OBS integration:
This bug (929690) was mentioned in
https://build.opensuse.org/request/show/305469 Factory / gnutls

Comment 2 Swamp Workflow Management 2015-05-05 22:00:46 UTC

bugbot adjusting priority

Comment 4 Bernhard Wiedemann 2015-08-03 14:00:12 UTC

This is an autogenerated message for OBS integration:
This bug (929690) was mentioned in
https://build.opensuse.org/request/show/320166 13.2+13.1 / gnutls

Comment 6 Swamp Workflow Management 2015-08-12 13:09:39 UTC

openSUSE-SU-2015:1372-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 929414,929690
CVE References: CVE-2015-3622
Sources used:
openSUSE 13.2 (src):    gnutls-3.2.18-11.1
openSUSE 13.1 (src):    gnutls-3.2.4-2.35.1

Comment 8 Swamp Workflow Management 2015-09-09 16:12:59 UTC

SUSE-SU-2015:1518-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 929414,929690,941794
CVE References: CVE-2015-3622,CVE-2015-6251
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    gnutls-3.2.15-11.1
SUSE Linux Enterprise Server 12 (src):    gnutls-3.2.15-11.1
SUSE Linux Enterprise Desktop 12 (src):    gnutls-3.2.15-11.1

Comment 9 Andreas Stieger 2016-01-11 17:05:22 UTC

All affected releases already fixed, closing.