gnutls-3.3.29-8.el7
エラータID: AXSA:2019-3543:01
リリース日:
2019/02/15 Friday - 12:27
題名:
gnutls-3.3.29-8.el7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- GnuTLS の HMAC-SHA-256 実装には Lucky thirteen攻撃と呼ばれる,
リモート攻撃者が巧妙に細工されたパケットを使ったタイミングデータの
統計解析を通じて,データの特定や平文の復元に使用することができる
脆弱性があります。(CVE-2018-10844)
- GnuTLS の HMAC-SHA-384 実装には Lucky thirteen攻撃と呼ばれる,
リモート攻撃者が巧妙に細工されたパケットを使ったタイミングデータの
統計解析を通じて,データの特定や平文の復元に使用することができる
脆弱性があります。 (CVE-2018-10845)
- GnuTLS の 実装には, 仮想マシン間で Prime probe 攻撃と Lucky
thirteen 攻撃を組み合わせ,巧妙に細工されたパケットを通じて平文の
復元が可能な脆弱性があります。(CVE-2018-10846)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2018-10844
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.
CVE-2018-10845
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.
CVE-2018-10846
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.
追加情報:
N/A
ダウンロード:
SRPMS
- gnutls-3.3.29-8.el7.src.rpm
MD5: 17e796c0e52eb9c043fd582e16f1aa9e
SHA-256: ba3c648680c371a9f9b9c1e8f94fa131e1a8e1401477453346bf2ec10ec91a63
Size: 9.50 MB
Asianux Server 7 for x86_64
- gnutls-3.3.29-8.el7.x86_64.rpm
MD5: 7129fde31d9e689c3c0e2145f822cd47
SHA-256: c409e8c9f922258e28198ca4dd30e8b5527952d6f5691e9336916ca9bfd9cd6f
Size: 679.26 kB - gnutls-c++-3.3.29-8.el7.x86_64.rpm
MD5: aef1a8292ae5580dd9d3fcaccb860da6
SHA-256: 850bef666b3ea73136e6b3ab8d4523822ee855333fbf73474667d4ffbe8fe393
Size: 33.45 kB - gnutls-dane-3.3.29-8.el7.x86_64.rpm
MD5: 364667bb806d4bd47e209b997df91725
SHA-256: 61c184ea53277d32e163993792a21b5bf2e05e5a212404592177daa45c64dddf
Size: 34.61 kB - gnutls-devel-3.3.29-8.el7.x86_64.rpm
MD5: 076bd9a44f0b457b4f3b7fae479e413a
SHA-256: 486dbc12eb1104fdcde1512205f50d179806f7a8ecb99155d0700d81609fa6bc
Size: 1.39 MB - gnutls-utils-3.3.29-8.el7.x86_64.rpm
MD5: b4de2f388480f9d7ac3197dca4ca0485
SHA-256: fc17400226d33efe54daaac4c8c5d718009b1a8c380f33f57122663d6395f5ef
Size: 237.29 kB - gnutls-3.3.29-8.el7.i686.rpm
MD5: a4dd7fc1e05704d36dba59da50a3af80
SHA-256: 563089f3e8f1bd2075a1c770222cfd305c75c24fdf70be8c57296d7693a5b61b
Size: 648.32 kB - gnutls-c++-3.3.29-8.el7.i686.rpm
MD5: 662ccab617dc60003c84e12b5782916a
SHA-256: 5063be52e2f584f07afa1fd4edc0f40953aa86e1ba87dcdcfdac44083efc1e11
Size: 34.04 kB - gnutls-dane-3.3.29-8.el7.i686.rpm
MD5: 80b8d79439981e064a28401d608d3467
SHA-256: 527a14bc55d5ef67ad4fbcee9263cf47fdf0794a114b9d5f41d91bef541fcf04
Size: 34.55 kB - gnutls-devel-3.3.29-8.el7.i686.rpm
MD5: 37f3bfc0907d69f068ae03ff7990b516
SHA-256: b795cc5c1876117ad17ca43c3c9890482538ac9723145115dc0899a365788c01
Size: 1.39 MB
English