Pedro Monreal Gonzalez
81f2d36642
* libgnutls: Fix NULL pointer dereference when 2nd Client Hello omits PSK
Reported by Stefan Bühler. [GNUTLS-SA-2025-07-07-4, CVSS: medium]
[bsc#1246299, CVE-2025-6395]
* libgnutls: Fix heap read buffer overrun in parsing X.509 SCTS timestamps
Spotted by oss-fuzz and reported by OpenAI Security Research Team,
and fix developed by Andrew Hamilton. [GNUTLS-SA-2025-07-07-1,
CVSS: medium] [bsc#1246233, CVE-2025-32989]
* libgnutls: Fix double-free upon error when exporting otherName in SAN
Reported by OpenAI Security Research Team. [GNUTLS-SA-2025-07-07-2,
CVSS: low] [bsc#1246232, CVE-2025-32988]
* certtool: Fix 1-byte write buffer overrun when parsing template
Reported by David Aitel. [GNUTLS-SA-2025-07-07-3,
CVSS: low] [bsc#1246267, CVE-2025-32990]
* libgnutls: PKCS#11 modules can now be used to override the default
cryptographic backend. Use the [provider] section in the system-wide config
to specify path and pin to the module (see system-wide config Documentation).
* libgnutls: Linux kernel version 6.14 brings a Kernel TLS (kTLS) key update
support. The library running on the aforementioned version now utilizes the
kernel’s key update mechanism when kTLS is enabled, allowing uninterrupted
TLS session. The --enable-ktls configure option as well as the system-wide
kTLS configuration(see GnuTLS Documentation) are still required to enable
this feature.
* libgnutls: liboqs support for PQC has been removed
For maintenance purposes, support for post-quantum cryptography
(PQC) is now only provided through leancrypto. The experimental key
exchange algorithm, X25519Kyber768Draft00, which is based on the
round 3 candidate of Kyber and only supported through liboqs has
also been removed altogether.
* libgnutls: TLS certificate compression methods can now be set with
OBS-URL: https://build.opensuse.org/package/show/security:tls/gnutls?expand=0&rev=129
35 lines
1.4 KiB
Diff
35 lines
1.4 KiB
Diff
Index: gnutls-3.8.10/tests/Makefile.am
|
|
===================================================================
|
|
--- gnutls-3.8.10.orig/tests/Makefile.am
|
|
+++ gnutls-3.8.10/tests/Makefile.am
|
|
@@ -628,8 +628,6 @@ ctests += win32-certopenstore
|
|
|
|
endif
|
|
|
|
-dist_check_SCRIPTS += pqc-hybrid-kx.sh
|
|
-
|
|
cpptests =
|
|
if ENABLE_CXX
|
|
if HAVE_CMOCKA
|
|
Index: gnutls-3.8.10/tests/Makefile.in
|
|
===================================================================
|
|
--- gnutls-3.8.10.orig/tests/Makefile.in
|
|
+++ gnutls-3.8.10/tests/Makefile.in
|
|
@@ -3293,7 +3293,7 @@ am__dist_check_SCRIPTS_DIST = rfc2253-es
|
|
gnutls-cli-self-signed.sh gnutls-cli-invalid-crl.sh \
|
|
gnutls-cli-rawpk.sh dh-fips-approved.sh p11-kit-trust.sh \
|
|
testpkcs11.sh certtool-pkcs11.sh pkcs11-tool.sh \
|
|
- p11-kit-load.sh danetool.sh tpmtool_test.sh pqc-hybrid-kx.sh
|
|
+ p11-kit-load.sh danetool.sh tpmtool_test.sh
|
|
AM_V_P = $(am__v_P_@AM_V@)
|
|
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
|
|
am__v_P_0 = false
|
|
@@ -7178,7 +7178,6 @@ dist_check_SCRIPTS = rfc2253-escape-test
|
|
$(am__append_18) $(am__append_20) $(am__append_21) \
|
|
$(am__append_23) $(am__append_25) $(am__append_26) \
|
|
$(am__append_27) $(am__append_29) $(am__append_30) \
|
|
- pqc-hybrid-kx.sh
|
|
@ENABLE_KTLS_TRUE@@WINDOWS_FALSE@ktls_keyupdate_SOURCES = tls13/key_update.c
|
|
@ENABLE_KTLS_TRUE@@WINDOWS_FALSE@ktls_keyupdate_CFLAGS = -DUSE_KTLS
|
|
@WINDOWS_FALSE@dtls_stress_SOURCES = dtls/dtls-stress.c
|