Re: GnuTLS session resumption exploit

Top Page
Attachments:
Message as email
+ (text/plain)
+ (text/html)
+ (text/plain)
Delete this message
Reply to this message
Author: Michael Butash via PLUG-discuss
Date:  
To: Main PLUG discussion list
CC: Michael Butash
Subject: Re: GnuTLS session resumption exploit
So pretty much everything that wants to create encrypted TLS network
connections uses it or a like library ,or their own TLS engine.

NSA must be slavering at this tidbit, or just already knew.

-mb


On Tue, Jun 9, 2020 at 8:08 PM der.hans via PLUG-discuss <
> wrote:

> Am 10. Jun, 2020 schwätzte Seabass via PLUG-discuss so:
>
> moin moin,
>
> > What exactly is gnutls used for?
> > Web servers, or do general users actually use this for TLS connections?
> > Or something else?
>
> I don't know, but I believe it's in the same category as OpenSSL, so could
> be anything that wants to use TLS.
>
> debian reverse depends shows 354 packages.
>
> $ apt-cache rdepends libgnutls30 | grep -vc ^lib
> 354
> $
>
> $ apt-cache rdepends libgnutls30 | grep -Evc '^ lib'
> 258
> $
>
> $ apt-cache rdepends libgnutls30 | grep -Ev '^  lib' | awk -F- '{print $1
> }' | sort -u | wc
>      141     142    1337
> $

>
> Here are some from that list:
>
> telepathy, weechat, vlc, wget, rsyslog, abiword, cups, emacs
>
> ciao,
>
> der.hans
>
> >> moin moin,
> >>
> >> GnuTLS sessions can be resumed, allowing man in the middle attacks
> >>
> >> get yer updates
> >>
> >> https://gitlab.com/gnutls/gnutls/-/issues/1011
> >>
> >> ciao,
> >>
> >> der.hans
>
> --
> # https://www.LuftHans.com https://www.PhxLinux.org
> # "Arguing that you don't care about the right to privacy because you have
> # nothing to hide is no different than saying you don't care about
> # free speech because you have nothing to say." -- Edward
> Snowden---------------------------------------------------
> PLUG-discuss mailing list -
> To subscribe, unsubscribe, or to change your mail settings:
> https://lists.phxlinux.org/mailman/listinfo/plug-discuss

---------------------------------------------------
PLUG-discuss mailing list -
To subscribe, unsubscribe, or to change your mail settings:
https://lists.phxlinux.org/mailman/listinfo/plug-discuss