1. Ubuntu Security Notices
  2. USN-4233-2

USN-4233-2: GnuTLS update

Publication date

23 January 2020

Overview

USN-4233-1 marked SHA1 as untrusted in GnuTLS with no workaround.

Releases

Packages

Details

USN-4233-1 disabled SHA1 being used for digital signature operations in
GnuTLS. In certain network environments, certificates using SHA1 may still
be in use. This update adds the %VERIFY_ALLOW_BROKEN and
%VERIFY_ALLOW_SIGN_WITH_SHA1 priority strings that can be used to
temporarily re-enable SHA1 until certificates can be replaced with a
stronger algorithm.

Original advisory details:

As a security improvement, this update marks SHA1 as being untrusted for
digital signature operations.

USN-4233-1 disabled SHA1 being used for digital signature operations in
GnuTLS. In certain network environments, certificates using SHA1 may still
be in use. This update adds the %VERIFY_ALLOW_BROKEN and
%VERIFY_ALLOW_SIGN_WITH_SHA1 priority strings that can be used to
temporarily re-enable SHA1 until certificates can be replaced with a
stronger algorithm.

Original advisory details:

As a security improvement, this update marks SHA1 as being untrusted for
digital signature operations.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
18.04 bionic libgnutls30 –  3.5.18-1ubuntu1.3
16.04 xenial libgnutls30 –  3.4.10-4ubuntu1.7

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›