Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-5419: The PKCS#7 padding check performed during decryption was not constant-time, potentially leaking information about the padding bytes through timing differences. The issue was reported in the issue tracker as #1815 by Doria Tang of Stony Brook University. Recommendation: To address the issue found, upgrade to GnuTLS 3.8.13 or later versions. CVE-2026-42013: Validation of certificates with oversized Subject Alternative Names would fall back to checking DNS hostnames against Common Name. CVE-2026-42012: Certificates containing URI or SRV Subject Alternative Names would fall back to checking DNS hostnames against Common Name, allowing potential misuse of such certificates beyond their original purpose. The issue was reported in the issue tracker as #1802 by Oleh Konko (1seal). CVE-2026-42011: Permitted name constraints were wrongfully ignored when prior CAs only had excluded name constraints, resulting in a name constraint bypass. The issue was reported in the issue tracker as #1824 by Haruto Kimura (Stella).
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | gnutls | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-c++ | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-c++-debuginfo | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-dane | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-dane-debuginfo | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-debuginfo | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-debugsource | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-devel | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-utils | 0:3.8.10-4.amzn2023.0.2 |
| Amazon Linux · 2023 | gnutls-utils-debuginfo | 0:3.8.10-4.amzn2023.0.2 |
Vulnerabilities 4
-
High 8.2
Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certi…
-
High 7.4
Gnutls: gnutls: security bypass due to incorrect name constraint handling
A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name cons…
-
High 7.1
Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate va…
-
Low 3.7
Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differ…