DSA-4652-1 gnutls28 -- security update

Debian Security Advisory

DSA-4652-1 gnutls28 -- security update

Date Reported:

04 Apr 2020

Affected Packages:

gnutls28

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 955556.
In Mitre's CVE dictionary: CVE-2020-11501.

More information:

A flaw was reported in the DTLS protocol implementation in GnuTLS, a library implementing the TLS and SSL protocols. The DTLS client would not contribute any randomness to the DTLS negotiation, breaking the security guarantees of the DTLS protocol.

For the stable distribution (buster), this problem has been fixed in version 3.6.7-4+deb10u3.

We recommend that you upgrade your gnutls28 packages.

For the detailed security status of gnutls28 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/gnutls28