[IT-SecNots] [SECURITY] [DSA 3408-1] gnutls26 security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3408-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
December 01, 2015                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : gnutls26
CVE ID         : CVE-2015-8313

It was discovered that GnuTLS, a library implementing the TLS and SSL
protocols, incorrectly validates the first byte of padding in CBC modes.
A remote attacker can possibly take advantage of this flaw to perform a
padding oracle attack.

For the oldstable distribution (wheezy), this problem has been fixed
in version 2.12.20-8+deb7u4.

We recommend that you upgrade your gnutls26 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWXdG9AAoJEAVMuPMTQ89E3A8P/3oF2gLHvUCGqn3rrcbr57lS
ekJKmIhhgEmU8/I33wGlRuu+50Avnj+VXZoOi5QcQn/bAZjECgCkTa1iXNsbXlAm
pTguEBpkI2IyntbojRVAyYrINMUKleiTkIMP/VQ8H7G5bGrZ9WEHx/OcrSUKP/6+
UV2ZNJ/glfuSSP0kLeZz6A4VykxM8cHIoHLKjKTs5MmavZiSJVtEaasF6oZXARik
L6q1GnprRcmZrDRBW20eFS2wiBt3RF0A29JQ+XC8eV7u+8iOVS60k+tt/8x8mAen
EJZSaVDlb6p7GMwYsVESt8IDuTwPD6KZD6ISxS6tfux1XbxoiX4TsxeXuAf5lgI4
yyqM9lC80/e1mLr4X9jl/at9zhoRJSh+3obLDkO6DS1l+AN/L7dcm5yon7iD4uzR
50yRVHLL3FJeLSkgNo9nYWnS6SDul/a1UbLqeKgCbbYo+CU6YYKNXL1svFaWLgjS
9raHH2nGoLWBc7RUz/V53EB+ExPhyIkITjU55CYKDFujAb/IuFYN563c4ekAvvVU
FYnqECY1iwlALRcWHVGZnrecQFK3ymL/k5XIx94Sk47zSwv/qkN+PfOdppYGjRmt
Enla0XU5Q+YBkAyoF62k8AT3aw/02ep+S3hoejZjXmtpVsJNjBwG9pX7znAP73A3
ZwJGTEQ4jzuoaWZO9LoD
=J2A7
-----END PGP SIGNATURE-----