From de04bbfdcc4a002695d4f85d53042f9ab0f5c52d Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Tue, 5 Aug 2025 14:49:53 +0200 Subject: [PATCH] package/gnutls: security bump to version 3.8.10 Fixes the following security issues: GNUTLS-SA-2025-07-08-1 CVE-2025-32989 Severity Medium; Heap read buffer overflow When an X.509 certificate contains an SCT (signed certificate timestamp) extension and its length field is malformed, the library could read the memory buffer past the boundary. The issue was reported in the issue tracker as . ------------------------------------------------------------------------------ GNUTLS-SA-2025-07-08-2 CVE-2025-32988 Severity Low; Memory corruption on error path When any error occurs during exporting a certificate with an otherName in the SAN (subject alternative name) extension, the library could potentially double free the ASN.1 structure. The issue was reported in the issue tracker as . ------------------------------------------------------------------------------ GNUTLS-SA-2025-07-08-3 CVE-2025-32990 Severity Low; Heap write buffer overflow When the certtool program is invoked with a template file with a number of string pairs for a single keyword, a NULL pointer could be written past the memory boundary. The issue was reported in the issue tracker as . ------------------------------------------------------------------------------ GNUTLS-SA-2025-07-08-4 CVE-2025-6395 Severity Medium; Denial of service When a TLS 1.3 handshake involves a Hello Retry Request and the second Client Hello omits the PSK which was present in the first Client Hello, the GnuTLS server can dereference a NULL pointer. The issue was reported in the issue tracker as . https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain (cherry picked from commit 16d4159d44b23a07e50aa458cb8b619c09f3fa1a) Signed-off-by: Thomas Perale --- package/gnutls/gnutls.hash | 4 ++-- package/gnutls/gnutls.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/gnutls/gnutls.hash b/package/gnutls/gnutls.hash index dcfe201f3d..1b2a7ba9b5 100644 --- a/package/gnutls/gnutls.hash +++ b/package/gnutls/gnutls.hash @@ -1,6 +1,6 @@ # Locally calculated after checking pgp signature -# https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.9.tar.xz.sig -sha256 69e113d802d1670c4d5ac1b99040b1f2d5c7c05daec5003813c049b5184820ed gnutls-3.8.9.tar.xz +# https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.10.tar.xz.sig +sha256 db7fab7cce791e7727ebbef2334301c821d79a550ec55c9ef096b610b03eb6b7 gnutls-3.8.10.tar.xz # Locally calculated sha256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986 COPYING sha256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95 COPYING.LESSERv2 diff --git a/package/gnutls/gnutls.mk b/package/gnutls/gnutls.mk index e71e411cf0..7536189429 100644 --- a/package/gnutls/gnutls.mk +++ b/package/gnutls/gnutls.mk @@ -6,7 +6,7 @@ # When bumping, make sure *all* --without-libfoo-prefix options are in GNUTLS_CONF_OPTS GNUTLS_VERSION_MAJOR = 3.8 -GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).9 +GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).10 GNUTLS_SOURCE = gnutls-$(GNUTLS_VERSION).tar.xz GNUTLS_SITE = https://www.gnupg.org/ftp/gcrypt/gnutls/v$(GNUTLS_VERSION_MAJOR) GNUTLS_LICENSE = LGPL-2.1+ (core library)