ID de Prueba:	1.3.6.1.4.1.25623.1.1.13.2021.145.01
Categoría:	Slackware Local Security Checks
Título:	Slackware: Security Advisory (SSA:2021-145-01)
Resumen:	The remote host is missing an update for the 'gnutls' package(s) announced via the SSA:2021-145-01 advisory.
Descripción:	Summary: The remote host is missing an update for the 'gnutls' package(s) announced via the SSA:2021-145-01 advisory. Vulnerability Insight: New gnutls packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/gnutls-3.6.16-i586-1_slack14.2.txz: Upgraded. Fixed potential miscalculation of ECDSA/EdDSA code backported from Nettle. In GnuTLS, as long as it is built and linked against the fixed version of Nettle, this only affects GOST curves. [CVE-2021-20305] Fixed potential use-after-free in sending 'key_share' and 'pre_shared_key' extensions. When sending those extensions, the client may dereference a pointer no longer valid after realloc. This happens only when the client sends a large Client Hello message, e.g., when HRR is sent in a resumed session previously negotiated large FFDHE parameters, because the initial allocation of the buffer is large enough without having to call realloc (#1151). [GNUTLS-SA-2021-03-10, CVSS: low] For more information, see: [link moved to references] (* Security fix *) +--------------------------+ Affected Software/OS: 'gnutls' package(s) on Slackware 14.2, Slackware current. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2021-20305 Debian Security Information: DSA-4933 (Google Search) https://www.debian.org/security/2021/dsa-4933 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/ https://security.gentoo.org/glsa/202105-31 https://bugzilla.redhat.com/show_bug.cgi?id=1942533 https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.