USN-2865-1: GnuTLS vulnerability

Ubuntu Security Notice USN-2865-1

8th January, 2016

gnutls26, gnutls28 vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

Ubuntu 15.04
Ubuntu 14.04 LTS
Ubuntu 12.04 LTS

Summary

GnuTLS could be made to expose sensitive information over the network.

Software description

gnutls26
– GNU TLS library
gnutls28
– GNU TLS library

Details

Karthikeyan Bhargavan and Gaetan Leurent discovered that GnuTLS incorrectly
allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were
able to perform a man-in-the-middle attack, this flaw could be exploited to
view sensitive information.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:: libgnutls-openssl27

3.3.8-3ubuntu3.2; libgnutls-deb0-28

3.3.8-3ubuntu3.2; libgnutlsxx28

3.3.8-3ubuntu3.2
Ubuntu 14.04 LTS:: libgnutlsxx27

2.12.23-12ubuntu2.4; libgnutls-openssl27

2.12.23-12ubuntu2.4; libgnutls26

2.12.23-12ubuntu2.4
Ubuntu 12.04 LTS:: libgnutlsxx27

2.12.14-5ubuntu3.11; libgnutls-openssl27

2.12.14-5ubuntu3.11; libgnutls26

2.12.14-5ubuntu3.11

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-7575

Source: ubuntu-usn

지락문화예술공작단