Bugzilla – Bug 1221747
VUL-0: CVE-2024-28835: gnutls: certtool crash when verifying a certificate chain
Last modified: 2024-07-17 16:30:04 UTC
** libgnutls: Fixed a bug where certtool crashed when verifying a certificate chain with more than 16 certificates. Reported by William Woodruff (#1525) and yixiangzhike (#1527). [GNUTLS-SA-2024-01-23, CVSS: medium] [CVE-2024-28835] https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html
Upstream: https://gitlab.com/gnutls/gnutls/commit/e369e67a
See also: https://gitlab.com/gnutls/gnutls/-/issues/1525
And also: https://gitlab.com/gnutls/gnutls/-/issues/1527
Trying with reproducer [0] with 37 certificates in the chain crashes only in: - SUSE:ALP:Source:Standard:1.0/gnutls - SUSE:SLE-15-SP4:Update/gnutls - SUSE:SLE-15-SP4:Update:Products:Micro53:Update/gnutls Already fixed: -openSUSE:Factory/gnutls
SUSE-SU-2024:1271-1: An update that solves two vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1221242, 1221746, 1221747 CVE References: CVE-2024-28834, CVE-2024-28835 Maintenance Incident: [SUSE:Maintenance:33311](https://smelt.suse.de/incident/33311/) Sources used: openSUSE Leap Micro 5.4 (src): gnutls-3.7.3-150400.4.44.1 openSUSE Leap 15.5 (src): gnutls-3.7.3-150400.4.44.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): gnutls-3.7.3-150400.4.44.1 SUSE Linux Enterprise Micro 5.4 (src): gnutls-3.7.3-150400.4.44.1 SUSE Linux Enterprise Micro 5.5 (src): gnutls-3.7.3-150400.4.44.1 Basesystem Module 15-SP5 (src): gnutls-3.7.3-150400.4.44.1 openSUSE Leap 15.4 (src): gnutls-3.7.3-150400.4.44.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1271-2: An update that solves two vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1221242, 1221746, 1221747 CVE References: CVE-2024-28834, CVE-2024-28835 Maintenance Incident: [SUSE:Maintenance:33311](https://smelt.suse.de/incident/33311/) Sources used: SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): gnutls-3.7.3-150400.4.44.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): gnutls-3.7.3-150400.4.44.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): gnutls-3.7.3-150400.4.44.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): gnutls-3.7.3-150400.4.44.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): gnutls-3.7.3-150400.4.44.1 SUSE Manager Proxy 4.3 (src): gnutls-3.7.3-150400.4.44.1 SUSE Manager Retail Branch Server 4.3 (src): gnutls-3.7.3-150400.4.44.1 SUSE Manager Server 4.3 (src): gnutls-3.7.3-150400.4.44.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:2546-1: An update that solves two vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1221242, 1221746, 1221747 CVE References: CVE-2024-28834, CVE-2024-28835 Maintenance Incident: [SUSE:Maintenance:34785](https://smelt.suse.de/incident/34785/) Sources used: SUSE Linux Enterprise Micro for Rancher 5.3 (src): gnutls-3.7.3-150400.8.1 SUSE Linux Enterprise Micro 5.3 (src): gnutls-3.7.3-150400.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.