Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-5260: For a server using an RSA key backed by a PKCS#11 token, a client sending an extremely short premaster secret during an RSA key exchange could trigger a short heap overread. CVE-2026-42015: Appending to a PKCS#12 bag that already contained 32 elements could write past the bag's internal array. CVE-2026-42014: Changing the Security Officer PIN with gnutls_pkcs11_token_set_pin() with oldpin == NULL for a token lacking a protected authentication path led to a use-after-free. CVE-2026-42010: Servers configured with RSA-PSK wrongfully matched usernames with NUL character in them to ones truncated to NUL character, which could lead to an authentication bypass. CVE-2026-42009: The comparator function used for ordering DTLS packets by sequence numbers did not follow qsort comparator contracts in case of packets with duplicate sequence numbers, which could lead to undefined behaviour. CVE-2026-3833: A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure. CVE-2026-33846: GnuTLS didn't check that DTLS fragments claimed a consistent message_length value. Additionally, a crucial array size check was missing, enabling an attacker to cause a heap overwrite.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | gnutls | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-c++ | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-c++-debuginfo | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-dane | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-dane-debuginfo | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-debuginfo | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-debugsource | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-devel | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-utils | 0:3.8.3-8.amzn2023.0.3 |
| Amazon Linux · 2023 | gnutls-utils-debuginfo | 0:3.8.3-8.amzn2023.0.3 |
Vulnerabilities 7
-
High 8.2
Gnutls: gnutls: information disclosure via heap overread in rsa key exchange
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could…
-
High 7.5
Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating th…
-
High 7.5
Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets …
-
High 7.1
Gnutls: gnutls: authentication bypass via nul character in username
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username…
-
Medium 6.6
Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin
A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks …
-
Medium 6.5
Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remo…
-
Medium 5.3
Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling
A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memo…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-33846.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-3833.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42009.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42010.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42014.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-42015.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-5260.html