CVE-2022-2509

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures.The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.(CVE-2022-2509)

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in kernel space.

The following packages have been upgraded to a later upstream version: gnutls (3.7.6), nettle (3.8).

Security Fix(es):

• gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [IBM 9.1] [P10] POWER10 performance enhancements for cryptography: nettle - incremental work (BZ#2102589)

• Allow enabling KTLS in Rocky Linux 9.1 (BZ#2108532)

• DES-CBC bag is decryptable under FIPS (BZ#2115314)

• allow signature verification using RSA keys <2k in FIPS mode (BZ#2119770)

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in kernel space.

The following packages have been upgraded to a later upstream version: gnutls (3.7.6), nettle (3.8).

Security Fix(es):

• gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• [IBM 9.1] [P10] POWER10 performance enhancements for cryptography: nettle - incremental work (BZ#2102589)
• Allow enabling KTLS in AlmaLinux 9.1 (BZ#2108532)
• DES-CBC bag is decryptable under FIPS (BZ#2115314)
• allow signature verification using RSA keys <2k in FIPS mode (BZ#2119770)

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2022-2509: Fix double free during gnutls_pkcs7_verify

• CVE-2022-2509: Fix double free during gnutls_pkcs7_verify

A double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function. (CVE-2022-2509)

This update for gnutls fixes the following issues:

• CVE-2022-2509: Fixed a double free issue during PKCS7 verification (bsc#1202020).

These are all security issues fixed in the gnutls-3.7.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gnutls fixes the following issues:

• CVE-2022-2509: Fixed a double free issue during PKCS7 verification (bsc#1202020).
• CVE-2021-4209: Fixed null pointer dereference in MD_UPDATE (bsc#1196167).

This update for gnutls fixes the following issues:

• CVE-2022-2509: Fixed a double free issue during PKCS7 verification (bsc#1202020).

This update for gnutls fixes the following issues:

• CVE-2022-2509: Fixed a double free issue during PKCS7 verification (bsc#1202020).

Non-security fixes:

• FIPS: Check minimum keylength for symmetric key generation [bsc#1190698]
• FIPS: Only allows ECDSA signature with valid set of hashes (SHA2 and SHA3) [bsc#1190698]
• FIPS: Provides interface for running library self tests on-demand [bsc#1198979]

It was discovered that GnuTLS incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-4209)

It was discovered that GnuTLS incorrectly handled the verification of certain pkcs7 signatures. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-2509)