PT-2020-22759 · Gnu · Gnutls
Published
2020-01-23
·
Updated
2020-01-23
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
GnuTLS (affected versions not specified)
Description
The issue concerns the use of SHA1 for digital signature operations in GnuTLS. In certain network environments, certificates using SHA1 may still be in use. This update marks SHA1 as untrusted for digital signature operations, which is a security improvement.
Recommendations
As a temporary workaround, consider using the %VERIFY ALLOW BROKEN and %VERIFY ALLOW SIGN WITH SHA1 priority strings to re-enable SHA1 until certificates can be replaced with a stronger algorithm.
Replace certificates using SHA1 with ones using a stronger algorithm to fully resolve the issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gnutls