Threats Tagged 'cve-2026-42014'

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS (CVE-2024-12133) * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification (CVE-2025-14831) * gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) * gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment (CVE-2026-33845) * gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010) * gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011) * gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs (CVE-2026-42012) * gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013) * gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260) * gnutls: Fix use-after-free in gnutls_pkcs11_token_set_pin (CVE-2026-42014) * gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling (CVE-2026-42015) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

This security update provides a functional equivalent of RHSA-2026:20613. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:20613.

A use-after-free vulnerability exists in the gnutls_pkcs11_token_set_pin function of GnuTLS, which is triggered when changing the Security Officer PIN with a NULL old PIN on tokens lacking a protected authentication path. This flaw can lead to memory corruption and potential denial of service. The vulnerability is rated as medium severity with a CVSS score of 6.6. Red Hat has released a security update addressing this issue in their Extended Life Cycle Support 7 packages.

A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

This update for gnutls fixes the following issues - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive (bsc#1263707). - CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange (bsc#1263715). - CVE-2026-42011: name constraint bypass leading to acceptance of invalid certificates during certificate validation (bsc#1263710). - CVE-2026-42013: certificate validation bypass when validating certificates with an oversized SAN (bsc#1263712). - CVE-2026-42014: use-after-free when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path (bsc#1263713). - CVE-2026-42015: memory corruption when appending to a PKCS#12 bag that already contains 32 elements (bsc#1263714).

This update for gnutls fixes the following issues - CVE-2026-3832: cert-session: fix multi-entry OCSP revocation bypass (bsc#1263706). - CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707). - CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715). - CVE-2026-5419: gnutls_cipher_decrypt3: make PKCS#7 unpadding branch free (bsc#1263716). - CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704). - CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705). - CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708). - CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709). - CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710). - CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711). - CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712). - CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713). - CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds chec (bsc#1263714).

This update for gnutls fixes the following issues - CVE-2025-14831: excessive resource consumption when verifying specially crafted malicious certificates containing a large number of name constraints and SANs (bsc#1257960). - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive (bsc#1263707). - CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange (bsc#1263715). - CVE-2026-33845: integer overflow and heap overrun when parsing fragments with zero length and non-zero offset during DTLS handshake (bsc#1263704). - CVE-2026-33846: heap overwrite during DTLS handshake fragment reassembly due to missing validations and checks (bsc#1263705). - CVE-2026-42009: undefined behavior resulting in a DoS when handling DTLS packets with duplicate sequence numbers (bsc#1263708). - CVE-2026-42010: authentication bypass when processing a PSK username with a NUL-character (bsc#1263709). - CVE-2026-42011: name constraint bypass leading to acceptance of invalid certificates during certificate validation (bsc#1263710). - CVE-2026-42012: spoofing of legitimate services and sensitive information interception via specially crafted certificates containing URIs or SRV SANs. (bsc#1263711). - CVE-2026-42013: certificate validation bypass when validating certificates with an oversized SAN (bsc#1263712). - CVE-2026-42014: use-after-free when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path (bsc#1263713). - CVE-2026-42015: memory corruption when appending to a PKCS#12 bag that already contains 32 elements (bsc#1263714).