DSA-4652: -1 gnutls28 -- security update

Published Apr 4, 2020

Updated

A flaw was reported in the DTLS protocol implementation in GnuTLS, a library implementing the TLS and SSL protocols. The DTLS client would not contribute any randomness to the DTLS negotiation, breaking the security guarantees of the DTLS protocol.

Affected Software

2 affected components

debian/gnutls28

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gnutls28 to a version that resolves this vulnerability.
Patch DSA-4652-1

Event History

Apr 4, 2020

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2020-11501

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the DTLS client functionality in Debian's gnutls28 package are affected. The reported flaw is specifically in the DTLS protocol implementation, not described as affecting other TLS or SSL uses.

What condition is required for exploitation?

An affected GnuTLS DTLS client must perform a DTLS negotiation. During that negotiation, the client fails to contribute randomness, which breaks DTLS security guarantees.