SUSE-SU-2023:4952-1

MEDIUM5.9

Security update for gnutls

Published Dec 21, 2023

Modified 2 years ago

Fix available

Details

Description of the patch:

This update for gnutls fixes the following issues:

CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange (bsc#1208143).
CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

Affected Packages

gnutls

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

libgnutls-devel

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

libgnutls30

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

libgnutls30-32bit

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

libgnutls30-hmac

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

libgnutls30-hmac-32bit

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

libgnutlsxx-devel

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

libgnutlsxx28

SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSSUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server 15 SP1-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP1

Fixed in:

3.6.7-150000.6.50.1

References

https://bugzilla.suse.com/1208143

https://bugzilla.suse.com/1217277

https://lists.suse.com/pipermail/sle-security-updates/2023-December/017522.html

https://www.suse.com/security/cve/CVE-2023-0361/

https://www.suse.com/security/cve/CVE-2023-5981/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2023/suse-su-20234952-1/

CVSS Analysis

CVSS v3.1

5.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.9/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Upstream

CVE-2023-0361 CVE-2023-5981

Ecosystems

SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1

Timeline

PublishedDec 21, 2023

ModifiedDec 21, 2023

SUSE-SU-2023:4952-1 | Mondoo Vulnerability Intelligence