[Technik] [SECURITY] [DSA 1182-1] New gnutls11 packages fix RSA signature forgery cryptographic weakness

[Noèl Köthe]

Am Freitag, den 22.09.2006, 17:34 +0200 schrieb Moritz Muehlenhoff:

> Debian Security Advisory DSA 1182-1                    security at debian.org
> http://www.debian.org/security/                         Moritz Muehlenhoff
> September 22nd, 2006                    http://www.debian.org/security/faq
> 
> Package        : gnutls11
> Vulnerability  : cryptographic weakness
> Problem-Type   : local
> Debian-specific: no
> CVE ID         : CVE-2006-4790

gnutls11 auf pima, pomo, yuma, cusa, cree, crow, wasco, kiowa, karuk,
kansa, acoma, h01, h02, h03 und cupa aktualisiert.

> For the stable distribution (sarge) this problem has been fixed in
> version 1.0.16-13.2sarge2.

changelog:
gnutls11 (1.0.16-13.2sarge2) stable-security; urgency=high

  * Pulled from upstream 1.4.2-->1.4.4:
       Fix PKCS#1 verification to avoid a variant of Bleichenbacher's Crypto
       06 rump session attack. See
       <http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html> (which is
       not exactly the same as the problem we fix here).  Reported by Yutaka
       OIWA <y.oiwa at aist.go.jp>.

       See GNUTLS-SA-2006-4 on http://www.gnutls.org/security.html for more
       information.
    CVE-2006-4790

 -- Andreas Metzler <ametzler at debian.org>  Sat, 16 Sep 2006 13:23:30 +0200

-- 
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : /archiv/technik/attachments/20060923/83e2c5dd/attachment.pgp