Threats affecting pkg:rpm/gnutls

A use-after-free vulnerability exists in the gnutls_pkcs11_token_set_pin function of GnuTLS, which is triggered when changing the Security Officer PIN with a NULL old PIN on tokens lacking a protected authentication path. This flaw can lead to memory corruption and potential denial of service. The vulnerability is rated as medium severity with a CVSS score of 6.6. Red Hat has released a security update addressing this issue in their Extended Life Cycle Support 7 packages.

CVE-2026-42013 is a vulnerability in the GnuTLS library where an oversized Subject Alternative Name (SAN) in a certificate causes the validation process to incorrectly fall back to checking the Common Name (CN) field. This flaw can allow remote attackers to bypass proper certificate validation, potentially enabling spoofing or man-in-the-middle attacks. The issue affects certain versions of GnuTLS in Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat has released an official security update that addresses this vulnerability.

CVE-2026-42011 is a vulnerability in the GnuTLS library where permitted name constraints were incorrectly ignored if previous Certificate Authorities only had excluded name constraints. This flaw allows a remote attacker to bypass critical name constraint checks during certificate validation, potentially leading to acceptance of invalid certificates. Such acceptance could enable spoofing or man-in-the-middle attacks. Red Hat has issued a security advisory with a fix for this vulnerability in their Extended Life Cycle Support 7 packages.

A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.

Red Hat has issued a security advisory for the gnutls library addressing two vulnerabilities: a potential crash during chain building/verification (CVE-2024-28835) and a Minerva side-channel information leak (CVE-2024-28834). These issues affect Red Hat Enterprise Linux 9.2 Extended Update Support (EUS) and related variants on multiple architectures including x86_64, s390x, ppc64le, and aarch64. The update is rated with moderate security impact. No CVSS score is provided in the advisory. The vulnerabilities have been fixed in updated gnutls packages available from Red Hat. Users should apply the provided updates to remediate these issues.