https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 13:25:57 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:1784 <p><strong>Affected:</strong> AlmaLinux:8: gnutls, AlmaLinux:8: gnutls-c++, AlmaLinux:8: gnutls-dane, AlmaLinux:8: gnutls-devel, AlmaLinux:8: gnutls-utils</p> <p>The gnutls package provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.</p> <p>This package update fixes a timing side-channel in deterministic ECDSA.</p> <p>Security Fix(es):</p> <p>* gnutls: vulnerable to Minerva side-channel information leak (CVE-2024-28834)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: gnutls, AlmaLinux:8: gnutls-c++, AlmaLinux:8: gnutls-dane, AlmaLinux:8: gnutls-devel, AlmaLinux:8: gnutls-utils</p> <p>The gnutls package provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.</p> <p>This package update fixes a timing side-channel in deterministic ECDSA.</p> <p>Security Fix(es):</p> <p>* gnutls: vulnerable to Minerva side-channel information leak (CVE-2024-28834)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:1784 https://cve.radiocsirt.org/vuln/bdu:2025-08089 bdu:2025-08089 https://cve.radiocsirt.org/vuln/bdu:2025-08089 https://cve.radiocsirt.org/vuln/bell-cve-2024-28834 <p><strong>Affected:</strong> Alpaquita:23: gnutls, Alpaquita:stream: gnutls</p> <p><strong>Affected:</strong> Alpaquita:23: gnutls, Alpaquita:stream: gnutls</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-28834 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/euvd-2026-260288 EUVD-2026-260288 https://cve.radiocsirt.org/vuln/euvd-2026-260288 https://cve.radiocsirt.org/vuln/fkie_cve-2024-28834 <p>A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.</p> <p>A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-28834 https://cve.radiocsirt.org/vuln/ghsa-frvc-6356-58xm <p>A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.</p> <p>A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.</p> https://cve.radiocsirt.org/vuln/ghsa-frvc-6356-58xm https://cve.radiocsirt.org/vuln/gsd-2024-28834 gsd-2024-28834 https://cve.radiocsirt.org/vuln/gsd-2024-28834 https://cve.radiocsirt.org/vuln/icsa-23-348-10 <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> <p>expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start o…</p> https://cve.radiocsirt.org/vuln/icsa-23-348-10 https://cve.radiocsirt.org/vuln/msrc_cve-2024-28834 msrc_CVE-2024-28834 https://cve.radiocsirt.org/vuln/msrc_cve-2024-28834 https://cve.radiocsirt.org/vuln/oesa-2024-1439 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: gnutls, openEuler:20.03-LTS-SP4: gnutls, openEuler:22.03-LTS: gnutls, openEuler:22.03-LTS-SP1: gnutls, openEuler:22.03-LTS-SP2: gnutls, openEuler:22.03-LTS-SP3: gnutls</p> <p>GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code. Security Fix(es): A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.(CVE-2024-28834)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: gnutls, openEuler:20.03-LTS-SP4: gnutls, openEuler:22.03-LTS: gnutls, openEuler:22.03-LTS-SP1: gnutls, openEuler:22.03-LTS-SP2: gnutls, openEuler:22.03-LTS-SP3: gnutls</p> <p>GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code. Security Fix(es): A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.(CVE-2024-28834)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1439 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13806-1 <p>gnutls-3.8.4-1.1 on GA media</p> <p>gnutls-3.8.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13806-1 https://cve.radiocsirt.org/vuln/rhsa-2024:1997 <p>gnutls: vulnerable to Minerva side-channel information leak</p> <p>gnutls: vulnerable to Minerva side-channel information leak</p> https://cve.radiocsirt.org/vuln/rhsa-2024:1997 https://cve.radiocsirt.org/vuln/suse-su-2024:1271-1 <p>Security update for gnutls</p> <p>Security update for gnutls</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1271-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-28834 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: gnutls28, Ubuntu:22.04:LTS: gnutls28, Ubuntu:24.04:LTS: gnutls28</p> <p>A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: gnutls28, Ubuntu:22.04:LTS: gnutls28, Ubuntu:24.04:LTS: gnutls28</p> <p>A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-28834 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0686 <p>Ein Angreifer kann mehrere Schwachstellen in GnuTLS ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in GnuTLS ausnutzen, um Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0686