SUSE-SU-2026:2923-1
SUSE-SU-2026:2923-1 · Security update for gnutls
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
This update for gnutls fixes the following issues - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive (bsc#1263707). - CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange (bsc#1263715). - CVE-2026-42011: name constraint bypass leading to acceptance of invalid certificates during certificate validation (bsc#1263710). - CVE-2026-42013: certificate validation bypass when validating certificates with an oversized SAN (bsc#1263712). - CVE-2026-42014: use-after-free when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path (bsc#1263713). - CVE-2026-42015: memory corruption when appending to a PKCS#12 bag that already contains 32 elements (bsc#1263714).
Есть исправление
- Опубликовано
- Обновлено
Стек: system
Затронутые продукты и версии
gnutls SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
- Затронутые диапазоны версий
- ECOSYSTEM: < 3.4.17-8.26.1
Обновитесь до 3.4.17-8.26.1
Первоисточники
- https://www.suse.com/support/update/announcement/2026/suse-su-20262923-1/
- https://bugzilla.suse.com/1263707
- https://bugzilla.suse.com/1263710
- https://bugzilla.suse.com/1263712
- https://bugzilla.suse.com/1263713
- https://bugzilla.suse.com/1263714
- https://bugzilla.suse.com/1263715
- https://www.suse.com/security/cve/CVE-2026-3833
- https://www.suse.com/security/cve/CVE-2026-42011
- https://www.suse.com/security/cve/CVE-2026-42013
- https://www.suse.com/security/cve/CVE-2026-42014
- https://www.suse.com/security/cve/CVE-2026-42015
- https://www.suse.com/security/cve/CVE-2026-5260
- https://osv.dev/vulnerability/SUSE-SU-2026:2923-1