1.90.0
cf-buildpacks-eng
released this
15 Apr 19:59
·
178 commits
to main
since this release
Notably, this release addresses:
USN-6733-1 GnuTLS vulnerabilities:
- CVE-2024-28835:
A flaw has been discovered in GnuTLS where an application crash can be
induced when attempting to verify a specially crafted .pem bundle using the
"certtool --verify-chain" command. - CVE-2024-28834:
A flaw was found in GnuTLS. The Minerva attack is a cryptographic
vulnerability that exploits deterministic behavior in systems like GnuTLS,
leading to side-channel leaks. In specific scenarios, such as when using
the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable
step in nonce size from 513 to 512 bits, exposing a potential timing
side-channel.
-ii libgnutls-dane0:amd64 3.7.3-4ubuntu1.4 amd64 GNU TLS library - DANE security support
-ii libgnutls-openssl27:amd64 3.7.3-4ubuntu1.4 amd64 GNU TLS library - OpenSSL wrapper
-ii libgnutls28-dev:amd64 3.7.3-4ubuntu1.4 amd64 GNU TLS library - development files
-ii libgnutls30:amd64 3.7.3-4ubuntu1.4 amd64 GNU TLS library - main runtime library
-ii libgnutlsxx28:amd64 3.7.3-4ubuntu1.4 amd64 GNU TLS library - C++ runtime library
+ii libgnutls-dane0:amd64 3.7.3-4ubuntu1.5 amd64 GNU TLS library - DANE security support
+ii libgnutls-openssl27:amd64 3.7.3-4ubuntu1.5 amd64 GNU TLS library - OpenSSL wrapper
+ii libgnutls28-dev:amd64 3.7.3-4ubuntu1.5 amd64 GNU TLS library - development files
+ii libgnutls30:amd64 3.7.3-4ubuntu1.5 amd64 GNU TLS library - main runtime library
+ii libgnutlsxx28:amd64 3.7.3-4ubuntu1.5 amd64 GNU TLS library - C++ runtime library```