Fedora 32 update for mingw-gnutls



| Updated: 2025-04-25
Risk Medium
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2018-10844
CVE-2018-10845
CVE-2018-10846
CVE-2020-11501
CWE-ID CWE-327
CWE-310
CWE-330
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

mingw-gnutls
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU15707

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-10844

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to usage of an insecure implementation of HMAC-SHA-256 algorithm vulnerable to a Lucky thirteen style attack. A remote attacker with ability to intercept traffic can recover encrypted data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 32

mingw-gnutls: before 3.6.13-1.fc32

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2020-f90fb78f70


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU15708

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-10845

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to usage of an insecure implementation of HMAC-SHA-384 algorithm vulnerable to a Lucky thirteen style attack. A remote attacker with ability to intercept traffic can recover encrypted data.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 32

mingw-gnutls: before 3.6.13-1.fc32

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2020-f90fb78f70


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cryptographic issues

EUVDB-ID: #VU15709

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-10846

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a cache-based side channel in GnuTLS implementation that can lead to recovery of data in cross-VM attack setting. A remote attacker with ability to intercept traffic can recover encrypted data using a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 32

mingw-gnutls: before 3.6.13-1.fc32

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2020-f90fb78f70


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of insufficiently random values

EUVDB-ID: #VU26487

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-11501

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt data.

The vulnerability exists in GnuTLS DTLS protocol implementation due to an error in code that caused DTLS client not to contribute any randomness to the DTLS negotiation. As a result a remote attacker with ability to intercept network traffic can decrypt data passed via TLS 1.3 connection and gain access to sensitive information.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 32

mingw-gnutls: before 3.6.13-1.fc32

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2020-f90fb78f70


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###