Home / mailings [SECURITY] [DSA 3437-1] gnutls26 security update
Posted on 09 January 2016
Debian Security Advisory-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3437-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 09, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : gnutls26
CVE ID : CVE-2015-7575
Karthikeyan Bhargavan and Gaetan Leurent at INRIA discovered a flaw in
the TLS 1.2 protocol which could allow the MD5 hash function to be used
for signing ServerKeyExchange and Client Authentication packets during a
TLS handshake. A man-in-the-middle attacker could exploit this flaw to
conduct collision attacks to impersonate a TLS server or an
authenticated TLS client.
More information can be found at
https://www.mitls.org/pages/attacks/SLOTH
For the oldstable distribution (wheezy), this problem has been fixed
in version 2.12.20-8+deb7u5.
We recommend that you upgrade your gnutls26 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
