PT-2020-22759 · Gnu · Gnutls

Published

2020-01-23

·

Updated

2020-01-23

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions GnuTLS (affected versions not specified)
Description The issue concerns the use of SHA1 for digital signature operations in GnuTLS. In certain network environments, certificates using SHA1 may still be in use. This update marks SHA1 as untrusted for digital signature operations, which is a security improvement.
Recommendations As a temporary workaround, consider using the %VERIFY ALLOW BROKEN and %VERIFY ALLOW SIGN WITH SHA1 priority strings to re-enable SHA1 until certificates can be replaced with a stronger algorithm. Replace certificates using SHA1 with ones using a stronger algorithm to fully resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

USN-4233-2

Affected Products

Gnutls