Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN141 _____________________________________________________________________ DATE : 10/02/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running GNUTLS versions prior to 3.8.12. ===================================================================== https://gnutls.org/security-new.html#GNUTLS-SA-2026-02-09-1 https://gnutls.org/security-new.html#GNUTLS-SA-2026-02-09-2 https://lists.gnutls.org/pipermail/gnutls-help/2026-February/004914.html _____________________________________________________________________ GNUTLS-SA-2026-02-09-1 CVE-2026-1584 Severity High; invalid pointer access A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server. The issue was reported in the issue tracker as #1790 by Jaehun Lee. Recommendation: To address the issue found, upgrade to GnuTLS 3.8.12 or later versions. 3.8.10 or earlier versions are not affected. _____________________________________________________________________ GNUTLS-SA-2025-11-18 CVE-2025-9820 Severity Low; Stack write buffer overflow When a PKCS#11 token is initialized with gnutls_pkcs11_token_init function and it is passed a token label longer than 32 characters, it may write past the boundary of stack allocated memory. The issue was reported in the issue tracker as #1732. Recommendation: Given the length limit is imposed by the PKCS#11 standard, the application should check and reject longer label exceeding the limit, though this was unclear in the GnuTLS documentation. If it is not feasible for some reason, we would recommend upgrading GnuTLS to 3.8.11 or later versions. The issue could also be effectively mitigated if you compile the library with -D_FORTIFY_SOURCE=2. _____________________________________________________________________ Hello, We have just released gnutls-3.8.12. This is a bug fix, security and enhancement release on the 3.8.x branch. We would like to thank everyone who contributed in this release: Alexander Sosedkin, Daiki Ueno, Mikhail Dmitrichenko, František Krenželok, Jan Palus, Julien Olivain, Markus Theil, Maxim Cournoyer, xinpeng wang. The detailed list of changes follows: * Version 3.8.12 (released 2026-02-09) ** libgnutls: Fix NULL pointer dereference in PSK binder verification A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello could lead to a denial of service attack via crashing the server. The updated code guards against the problematic dereference. Reported by Jaehun Lee. [Fixes: GNUTLS-SA-2026-02-09-1, CVSS: high] [CVE-2026-1584] ** libgnutls: Fix name constraint processing performance issue Verifying certificates with pathological amounts of name constraints could lead to a denial of service attack via resource exhaustion. Reworked processing algorithms exhibit better performance characteristics. Reported by Tim Scheckenbach. [Fixes: GNUTLS-SA-2026-02-09-2, CVSS: medium] [CVE-2025-14831] ** libgnutls: Fix multiple unexploitable overflows Reported by Tim Rühsen (#1783, #1786). ** libgnutls: Fall back to thread-unsafe module initialization Improve fallback handling for PKCS#11 modules that don't support thread-safe initialization (#1774). Also return filename from p11_kit_module_get_name() for unconfigured modules. ** libgnutls: Accept NULL as digest argument for gnutls_hash_output The accelerated implementation of gnutls_hash_output() now properly accepts NULL as the digest argument, matching the behavior of the reference implementation (#1769). ** srptool: Avoid a stack buffer overflow when processing large SRP groups. Reported and fixed by Mikhail Dmitrichenko (#1777). ** API and ABI modifications: No changes since last version. Getting the Software ================ GnuTLS may be downloaded directly from https://www.gnupg.org/ftp/gcrypt/ A list of GnuTLS mirrors can be found at http://www.gnutls.org/download.html Here are the XZ compressed sources: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.12.tar.xz Here are OpenPGP detached signatures signed using keys: 5D46CB0F763405A7053556F47A75A648B3F9220C and E987AB7F7E89667776D05B3BB0E9DD20B29F1432 https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.12.tar.xz.sig Note that it has been signed with the following openpgp keys: pub ed25519 2021-12-23 [SC] [expires: 2027-01-01] 5D46CB0F763405A7053556F47A75A648B3F9220C uid [ultimate] Zoltan Fridrich sub cv25519 2021-12-23 [E] [expires: 2027-01-01] pub rsa4096 2016-09-27 [SC] E987AB7F7E89667776D05B3BB0E9DD20B29F1432 uid [ultimate] Alexander Sosedkin sub rsa4096 2021-08-21 [A] sub rsa4096 2016-09-27 [E] sub rsa4096 2016-09-27 [S] Regards, Alexander Sosedkin -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 849 bytes Desc: not available URL: ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================