USN-6733-2: GnuTLS vulnerabilities
USN-6733-1 fixed vulnerabilities in GnuTLS. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: It was discovered that GnuTLS had a timing side-channel when performing certain ECDSA operations. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2024-28834) It was discovered that GnuTLS incorrectly handled verifying certain PEM bundles. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-28835)
Affected Software
Event History
Frequently Asked Questions
What vulnerabilities are fixed by USN-6733-2?
USN-6733-2 addresses timing side-channel vulnerabilities in GnuTLS related to ECDSA operations.
What is the severity of USN-6733-2?
The severity of USN-6733-2 is critical due to potential remote exploitation risks.
How do I fix the vulnerabilities in USN-6733-2?
To fix the vulnerabilities in USN-6733-2, ensure you update to the patched version of libgnutls30t64, specifically version 3.8.3-1.1ubuntu3.1.
Which Ubuntu version is affected by USN-6733-2?
USN-6733-2 affects Ubuntu 24.04 LTS.
Who should be concerned about USN-6733-2?
System administrators and users of Ubuntu 24.04 LTS that utilize GnuTLS should be concerned about USN-6733-2.