The gnutls package in Red Hat Enterprise Linux 9 is affected by two security vulnerabilities. CVE-2024-28834 involves a Minerva side-channel information leak, which could potentially expose sensitive information through side-channel attacks. CVE-2024-28835 can cause a crash during the process of building or verifying certificate chains, potentially leading to denial of service. Red Hat has released updated gnutls packages as part of advisory RHSA-2024:2570 to remediate these issues. The advisory covers various architectures including x86_64, s390x, ppc64le, and aarch64. The vulnerabilities are rated with moderate severity by Red Hat Product Security. No CVSS scores are provided in the advisory, and no active exploitation has been reported.

The Minerva side-channel vulnerability (CVE-2024-28834) could allow attackers to leak sensitive cryptographic information through side-channel analysis, potentially compromising confidentiality. The crash vulnerability (CVE-2024-28835) may cause denial of service by crashing the gnutls library during certificate chain processing. Both issues affect the security and stability of applications relying on gnutls for TLS/SSL communications. No known exploits in the wild have been reported, and the overall impact is rated moderate.

Red Hat has released updated gnutls packages to address these vulnerabilities. Users of Red Hat Enterprise Linux 9 should apply the security update as detailed in advisory RHSA-2024:2570. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official guidance at https://access.redhat.com/articles/11258 for update instructions. Applying the update will mitigate both the side-channel information leak and the crash vulnerabilities.