GnuTLS patches huge security hole that hung around for two years – worse than Heartbleed

guest · Jun 10, 2020

GnuTLS patches huge security hole that hung around for two years – worse than Heartbleed, says Google cryptoboffin
June 10, 2020
https://www.theregister.com/2020/06/10/gnutls_patches_security_hole/

GnuTLS, a widely used open source library implementing Transport Layer Security, last week fixed a bug that had been hiding in the code for almost two years that made resumed TLS 1.3 sessions vulnerable to attack.

The flaw allowed GnuTLS servers to use session tickets issued during a previous secure TLS 1.3 session without accessing the function that generates secret keys, gnutls_session_ticket_key_generate(). An attacker capable of exploiting this vulnerability could bypass authentication under TLS 1.3 and could recover previous conversations under TLS 1.2.
Click to expand...

The bug, introduced in GnuTLS 3.6.4 (Sep. 24, 2018), was fixed in GnuTLS 3.6.14 (June 3, 2020).
Via Twitter, Andrew Ayer, founder of SSLMate, laid into the GnuTLS code for devising a complicated key rotation system that doesn't actually work.

"All their 'rotation' did was add a vulnerability," he said.
Click to expand...

Log in or Sign up

GnuTLS patches huge security hole that hung around for two years – worse than Heartbleed

guest Guest

Log in or Sign up

GnuTLS patches huge security hole that hung around for two years – worse than Heartbleed

guest Guest

Useful Searches