http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hun...
Putting aside the slightly hysterical tone of the article, this is appears to be a real bug with potentially serious implications. I see that Koji has an updated rpm for F21 and wonder if this will be backported to F20 and F19. Like *soon*.
poc
On Wed, Mar 05, 2014 at 12:01:04AM +0000, Patrick O'Callaghan wrote:
http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hun... Putting aside the slightly hysterical tone of the article, this is appears to be a real bug with potentially serious implications. I see that Koji has an updated rpm for F21 and wonder if this will be backported to F20 and F19. Like *soon*.
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
These need testing and karma.
On 04/03/14 08:26 PM, Matthew Miller wrote:
On Wed, Mar 05, 2014 at 12:01:04AM +0000, Patrick O'Callaghan wrote:
http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hun... Putting aside the slightly hysterical tone of the article, this is appears to be a real bug with potentially serious implications. I see that Koji has an updated rpm for F21 and wonder if this will be backported to F20 and F19. Like *soon*.
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
These need testing and karma.
Tested and karma'ed.
On 05.03.2014, Matthew Miller wrote:
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
Do they fix the bug?
On 03/05/14 14:18, Heinz Diehl wrote:
On 05.03.2014, Matthew Miller wrote:
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
Do they fix the bug?
Well.... The article pointed to by poc states....
GnuTLS developers published this bare-bones advisory that urges all users to upgrade to version 3.2.12. The flaw, formally indexed as CVE-2014-0092, is described by a GnuTLS developer as "an important (and at the same time embarrassing) bug discovered during an audit for Red Hat." Debian's advisory is here.
And the links above state....
Bugs Fixed 1069865 - CVE-2014-0092: gnutls: incorrect error handling in certificate verification (GNUTLS-SA-2014-2) 1071795 - CVE-2014-0092: gnutls: incorrect error handling in certificate verification (GNUTLS-SA-2014-2) [fedora-all]
So.......
On Wed, Mar 5, 2014 at 1:26 AM, Matthew Miller mattdm@fedoraproject.org wrote:
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
These need testing and karma.
AFAIK 3.1.20 is not the bugfixed version. It needs to be 3.2.12, which is still only available for F21.
poc
On 03/05/14 18:21, Patrick O'Callaghan wrote:
On Wed, Mar 5, 2014 at 1:26 AM, Matthew Miller mattdm@fedoraproject.org wrote:
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
These need testing and karma.
AFAIK 3.1.20 is not the bugfixed version. It needs to be 3.2.12, which is still only available for F21.
poc
So, you're saying the comments in those links are inaccurate?
On Wed, Mar 5, 2014 at 10:28 AM, Ed Greshko ed.greshko@greshko.com wrote:
On 03/05/14 18:21, Patrick O'Callaghan wrote:
On Wed, Mar 5, 2014 at 1:26 AM, Matthew Miller mattdm@fedoraproject.org wrote:
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
These need testing and karma.
AFAIK 3.1.20 is not the bugfixed version. It needs to be 3.2.12, which is still only available for F21.
poc
So, you're saying the comments in those links are inaccurate?
I'm just wondering why the version numbers don't correspond to those in the GnuTLS advisory:
http://www.gnutls.org/security.html#GNUTLS-SA-2014-2
poc
On Wed, 5 Mar 2014 11:29:23 +0000 "Patrick O'Callaghan" pocallaghan@gmail.com wrote:
On Wed, Mar 5, 2014 at 10:28 AM, Ed Greshko ed.greshko@greshko.com wrote:
On 03/05/14 18:21, Patrick O'Callaghan wrote:
On Wed, Mar 5, 2014 at 1:26 AM, Matthew Miller mattdm@fedoraproject.org wrote:
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
These need testing and karma.
AFAIK 3.1.20 is not the bugfixed version. It needs to be 3.2.12, which is still only available for F21.
poc
So, you're saying the comments in those links are inaccurate?
I'm just wondering why the version numbers don't correspond to those in the GnuTLS advisory:
Most likely because the patch has been applied, as the maintainer didn't want to do a version bump on a core package.
On 03/05/14 07:26, Matthew Miller wrote:
On Wed, Mar 05, 2014 at 12:01:04AM +0000, Patrick O'Callaghan wrote:
http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hun... Putting aside the slightly hysterical tone of the article, this is appears to be a real bug with potentially serious implications. I see that Koji has an updated rpm for F21 and wonder if this will be backported to F20 and F19. Like *soon*.
https://admin.fedoraproject.org/updates/FEDORA-2014-3413/gnutls-3.1.20-4.fc2... https://admin.fedoraproject.org/updates/FEDORA-2014-3363/gnutls-3.1.20-4.fc1...
These need testing and karma.
which is exactly why i get these email headers:
From: bugzilla@redhat.com To: rhsa-announce@redhat.com, enterprise-watch-list@redhat.com
*all* fedora project users should be subscribed.
List-Subscribe: https://www.redhat.com/mailman/listinfo/rhsa-announce mailto:rhsa-announce-request@redhat.com?subject=subscribe