Mageia alert MGASA-2014-0117 (gnutls)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2014-0117: Updated gnutls packages fix security vulnerability 
Date:
    	     
 
Mon, 3 Mar 2014 21:07:43 +0100
Message-ID:
    	     
 
<20140303200743.55C5A417D4@valstar.mageia.org>
MGASA-2014-0117 - Updated gnutls packages fix security vulnerability

Publication date: 03 Mar 2014
URL: http://advisories.mageia.org/MGASA-2014-0117.html
Type: security
Affected Mageia releases: 3, 4
CVE: CVE-2014-0092

Description:
It was discovered that GnuTLS did not correctly handle certain errors that
could occur during the verification of an X.509 certificate, causing it to
incorrectly report a successful verification. An attacker could use this
flaw to create a specially crafted certificate that could be accepted by
GnuTLS as valid for a site chosen by the attacker (CVE-2014-0092).

References:
- https://bugs.mageia.org/show_bug.cgi?id=12922
- http://gnutls.org/security.html#GNUTLS-SA-2014-2
- https://rhn.redhat.com/errata/RHSA-2014-0246.html
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092

SRPMS:
- 4/core/gnutls-3.2.7-1.2.mga4
- 3/core/gnutls-3.1.16-1.2.mga3