Bug 805432 (CVE-2012-1573)

Summary:

CVE-2012-1573 gnutls: TLS record handling issue (GNUTLS-SA-2012-2, MU-201202-01)

Product:

[Other] Security Response

Reporter:

Stefan Cornelius <scorneli>

Component:

vulnerability

Assignee:

Red Hat Product Security <security-response-team>

Status:

CLOSED ERRATA

QA Contact:

Severity:

high

Docs Contact:

Priority:

high

Version:

unspecified

CC:

erik-fedora, jgalipea, jorton, ktietz, omoris, osoukup, rjones, tmraz

Target Milestone:

---

Keywords:

Security

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2014-03-14 09:45:14 UTC

Type:

---

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

805074, 805075, 805078, 805079, 805438, 805439, 805440, 805441, 841165, 1063396

Bug Blocks:

804921

Attachments:

Description	Flags
Local copy of the Mu Dynamics advisory text	none

Description Stefan Cornelius 2012-03-21 09:49:29 UTC

GnuTLS 3.0.15 was released fixing the following issue:

** libgnutls: Corrections in record packet parsing.
Reported by Matthew Hall.
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912

Patch for 2.x:
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=422214868061370aeeb0ac9cd0f021a5c350a57d

Patch for 3.x:
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=b495740f2ff66550ca9395b3fda3ea32c3acb185

Comment 3 Stefan Cornelius 2012-03-21 10:10:25 UTC

Created gnutls tracking bugs for this issue

Affects: fedora-all [bug 805440]

Comment 4 Stefan Cornelius 2012-03-21 10:10:29 UTC

Created mingw32-gnutls tracking bugs for this issue

Affects: fedora-all [bug 805441]

Comment 6 Stefan Cornelius 2012-03-23 13:08:20 UTC

Acknowledgements:

Red Hat would like to thank Matthew Hall of Mu Dynamics for reporting this issue.

Comment 9 errata-xmlrpc 2012-03-27 22:56:58 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0429 https://rhn.redhat.com/errata/RHSA-2012-0429.html

Comment 10 errata-xmlrpc 2012-03-27 22:57:20 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0428 https://rhn.redhat.com/errata/RHSA-2012-0428.html

Comment 11 Fedora Update System 2012-04-11 03:49:30 UTC

gnutls-2.10.5-3.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2012-04-11 17:00:10 UTC

gnutls-2.10.5-3.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 errata-xmlrpc 2012-04-17 17:54:12 UTC

This issue has been addressed in following products:

  RHEV-H, V2V and Agents for RHEL-5

Via RHSA-2012:0488 https://rhn.redhat.com/errata/RHSA-2012-0488.html

Comment 14 errata-xmlrpc 2012-04-30 17:16:42 UTC

This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2012:0531 https://rhn.redhat.com/errata/RHSA-2012-0531.html

Comment 15 Murray McAllister 2013-03-07 02:42:40 UTC

External Reference:

(none)

Comment 16 Tomas Hoger 2013-03-19 09:29:43 UTC

Created attachment 712480 [details]
Local copy of the Mu Dynamics advisory text

It seem the company got acquired and its main web site is no longer working.