SB2020042943 - Fedora 32 update for mingw-gnutls

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2018-10844)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to usage of an insecure implementation of HMAC-SHA-256 algorithm vulnerable to a Lucky thirteen style attack. A remote attacker with ability to intercept traffic can recover encrypted data.

2) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2018-10845)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to usage of an insecure implementation of HMAC-SHA-384 algorithm vulnerable to a Lucky thirteen style attack. A remote attacker with ability to intercept traffic can recover encrypted data.

3) Cryptographic issues (CVE-ID: CVE-2018-10846)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a cache-based side channel in GnuTLS implementation that can lead to recovery of data in cross-VM attack setting. A remote attacker with ability to intercept traffic can recover encrypted data using a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack.

4) Use of insufficiently random values (CVE-ID: CVE-2020-11501)

The vulnerability allows a remote attacker to decrypt data.

The vulnerability exists in GnuTLS DTLS protocol implementation due to an error in code that caused DTLS client not to contribute any randomness to the DTLS negotiation. As a result a remote attacker with ability to intercept network traffic can decrypt data passed via TLS 1.3 connection and gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2020-f90fb78f70