Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat GnuTLS Security Update Leaves Systems Open to Eavesdropping

published 2 years ago

Summary

A security update for Red Hat GnuTLS has been released to fix a vulnerability that could allow an attacker to intercept sensitive information, such as passwords and credit card numbers, sent between a user's system and a server. This update is important for all users of Red Hat GnuTLS to ensure the security of their online communications. Users should update their systems as soon as possible to apply the fix.

What to do

Update redhat gnutls-c++ to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-c++-debuginfo to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-dane to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-dane-debuginfo to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-debuginfo to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-debugsource to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-devel to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-utils to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls-utils-debuginfo to version 0:3.6.16-5.el8_6.4.
Update redhat gnutls to version 0:3.6.16-5.el8_6.4.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-c++	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-c++-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-dane	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-dane-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-debugsource	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-devel	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-utils	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::appstream	redhat	gnutls-utils-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::baseos	redhat	gnutls	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::baseos	redhat	gnutls-c++-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::baseos	redhat	gnutls-dane-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::baseos	redhat	gnutls-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::baseos	redhat	gnutls-debugsource	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4
Red Hat:rhel_eus:8.6::baseos	redhat	gnutls-utils-debuginfo	< 0:3.6.16-5.el8_6.4 Fix: upgrade to 0:3.6.16-5.el8_6.4

Original advisory text

Red Hat Security Advisory: gnutls security update

References

https://access.redhat.com/errata/RHSA-2024:2044 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2269228 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2044.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-28834 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-28834 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-28834 Vendor Advisory
https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html Third Party Advisory
https://minerva.crocs.fi.muni.cz/ Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.3 Medium

Timeline

Published12 Sep 2024

Updated4 Jul 2026

First seen4 Jul 2026

Sources

RHSA-2024:2044 · OSV

Track software like this

Free during beta