Amazon Linux 1 Security Advisory: ALAS-2013-172
Advisory Release Date: 2013-03-14 22:04 Pacific
Advisory Updated Date: 2014-09-15 22:41 Pacific
Severity:
Medium
Issue Overview:
It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle. (CVE-2013-1619)
Affected Packages:
gnutls
Issue Correction:
Run yum update gnutls to update your system.
New Packages:
i686:
gnutls-guile-2.8.5-10.9.amzn1.i686
gnutls-2.8.5-10.9.amzn1.i686
gnutls-debuginfo-2.8.5-10.9.amzn1.i686
gnutls-utils-2.8.5-10.9.amzn1.i686
gnutls-devel-2.8.5-10.9.amzn1.i686
src:
gnutls-2.8.5-10.9.amzn1.src
x86_64:
gnutls-utils-2.8.5-10.9.amzn1.x86_64
gnutls-2.8.5-10.9.amzn1.x86_64
gnutls-devel-2.8.5-10.9.amzn1.x86_64
gnutls-debuginfo-2.8.5-10.9.amzn1.x86_64
gnutls-guile-2.8.5-10.9.amzn1.x86_64