GnuTLS Token Leak Threatens Open Source Supply Chain
A serious bug in GnuTLS, the encryption library used by many Linux systems, accidentally exposed secret security tokens. Attackers could use these tokens to break into systems that trust GnuTLS, including major Linux distributions like Debian and Ubuntu.
- Severity
- Not scoredNo CVSS score recorded
- Fix
- Fixed in 3.7.9
How it works
- GnuTLS, the encryption library used by Linux systems, accidentally exposed secret security tokens.
- When a program using GnuTLS sends encrypted data, it creates a temporary security token to prove the data is valid.
- In this case, the token was not properly deleted after use, so anyone who could access the system's memory could read it.
- Attackers could then use these tokens to trick systems into accepting fake data as real, breaking encryption and allowing unauthorized access.
What to do
Check if you're using GnuTLS versions 3.7.0 through 3.7.8 on your Linux system. Run the command gnutls-cli --version to see your installed version. If it falls within this range, your system is affected. You can also check installed packages with apt list --installed gnutls2.8 (Debian/Ubuntu) or dnf list installed gnutls (Fedora).
Update GnuTLS to version 3.7.9 or later immediately. On Debian/Ubuntu, run sudo apt update && sudo apt upgrade gnutls2.8. On Fedora, run sudo dnf upgrade gnutls. After updating, verify the new version with gnutls-cli --version to confirm the fix is applied. If you can't update, disable GnuTLS-based services until a patch is applied.
Technical details
A critical GnuTLS token leak via a GitLab CI artifact exposure put major Linux distributions at risk. Learn how this supply chain vulnerability occurred.