4 ms·

I was wondering how commonly used gnutls was. Gnutls is required by (among others) ffmpeg, emacs, vlc and wget.

cesarb 6y ago
This bug is on the TLS server code, so the relevant question would be how commonly used gnutls is as a TLS server. Luckily, gnutls seems to be more popular as a client library than as a server library.
- SomeoneFromCA 6y ago
  I use it on a server. Way easier to use than opennsl, to my taste.
typical182 6y ago
In terms of where it is used, here is a related tweet by Filippo Valsorda: https://twitter.com/FiloSottile/status/1270115515378384897 https://twitter.com/FiloSottile/status/1270115515378384897 For scale, this GnuTLS vulnerability is considerably worse than Heartbleed. If you use Linux distributions with GNU tendencies, you might want to check your dependency trees. (He is a cryptographer on the Go project, who also happened to win the CloudFlare Heartbleed Challenge). As he says, that thread is a good starting point for potentially vulnerable uses. Some sample quotes from that thread: —— The good news is that this is a server-side issue —— For obvious reasons, systemd ships a custom http server with client auth via GnuTLS. —— On Fedora "dnf repoquery --whatrequires gnutls" lists: Samba NetworkManager pacemaker qemu / libvirt wget rdesktop tigervnc gnupg Apache mod_gnutls ...
- simias 6y ago
  >For obvious reasons, systemd ships a custom http server with client auth via GnuTLS. I can't tell if that's a joke poking fun at systemd's bloat or a genuine comment. What does systemd need an HTTP server for? Is it enabled by default on most distros?
  - cesarb 6y ago
    It's probably systemd-journal-gatewayd (https://www.freedesktop.org/software/systemd/man/systemd-journal-gatewayd.service.html https://www.freedesktop.org/software/systemd/man/systemd-jou...) or systemd-journal-remote (https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.service.html https://www.freedesktop.org/software/systemd/man/systemd-jou...), and I don't think I've ever seen either enabled, by default or otherwise (and at least on this machine, they don't even seem to be installed; they might be on another package, or they might not be compiled by default).
eddieoz 6y ago
I searched their wikipedia page (https://en.wikipedia.org/wiki/GnuTLS https://en.wikipedia.org/wiki/GnuTLS) and there are many applications that rely on gnutls: GNOME, CenterIM, Exim, Weechat, Mutt, Wireshark, slrn, Lynx, CUPS, gnoMint, GNU Emacs, Synology DiskStation Manager, OpenConnect
- smnthermes 6y ago
  Claws Mail uses it as well: https://www.claws-mail.org/downloads.php https://www.claws-mail.org/downloads.php

This bug is on the TLS server code, so the relevant question would be how commonly used gnutls is as a TLS server. Luckily, gnutls seems to be more popular as a client library than as a server library.

SomeoneFromCA 6y ago
I use it on a server. Way easier to use than opennsl, to my taste.

typical182 6y ago

In terms of where it is used, here is a related tweet by Filippo Valsorda: https://twitter.com/FiloSottile/status/1270115515378384897 https://twitter.com/FiloSottile/status/1270115515378384897 For scale, this GnuTLS vulnerability is considerably worse than Heartbleed. If you use Linux distributions with GNU tendencies, you might want to check your dependency trees. (He is a cryptographer on the Go project, who also happened to win the CloudFlare Heartbleed Challenge). As he says, that thread is a good starting point for potentially vulnerable uses. Some sample quotes from that thread: —— The good news is that this is a server-side issue —— For obvious reasons, systemd ships a custom http server with client auth via GnuTLS. —— On Fedora "dnf repoquery --whatrequires gnutls" lists: Samba NetworkManager pacemaker qemu / libvirt wget rdesktop tigervnc gnupg Apache mod_gnutls ...

simias 6y ago
>For obvious reasons, systemd ships a custom http server with client auth via GnuTLS. I can't tell if that's a joke poking fun at systemd's bloat or a genuine comment. What does systemd need an HTTP server for? Is it enabled by default on most distros?
- cesarb 6y ago
  It's probably systemd-journal-gatewayd (https://www.freedesktop.org/software/systemd/man/systemd-journal-gatewayd.service.html https://www.freedesktop.org/software/systemd/man/systemd-jou...) or systemd-journal-remote (https://www.freedesktop.org/software/systemd/man/systemd-journal-remote.service.html https://www.freedesktop.org/software/systemd/man/systemd-jou...), and I don't think I've ever seen either enabled, by default or otherwise (and at least on this machine, they don't even seem to be installed; they might be on another package, or they might not be compiled by default).

eddieoz 6y ago

I searched their wikipedia page (https://en.wikipedia.org/wiki/GnuTLS https://en.wikipedia.org/wiki/GnuTLS) and there are many applications that rely on gnutls: GNOME, CenterIM, Exim, Weechat, Mutt, Wireshark, slrn, Lynx, CUPS, gnoMint, GNU Emacs, Synology DiskStation Manager, OpenConnect

smnthermes 6y ago
Claws Mail uses it as well: https://www.claws-mail.org/downloads.php https://www.claws-mail.org/downloads.php