Gentoo: GLSA-202004-06: GnuTLS: DTLS protocol regression
Summary
It was discovered that DTLS client did not contribute any randomness to the DTLS negotiation.
Resolution
All GnuTLS users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/gnutls-3.6.13"
References
[ 1 ] GNUTLS-SA-2020-03-31 https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202004-06
Concerns
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
Background
GnuTLS is an Open Source implementation of the TLS and SSL protocols.
Affected Packages
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/gnutls < 3.6.13 >= 3.6.13
Impact
===== Please review the referenced advisory for details.
Workaround
There is no known workaround at this time.