{"id":"CLSA-2026-1784559374","summary":"Fix CVE(s): CVE-2026-42011, CVE-2026-42012, CVE-2026-42013","details":"   * SECURITY UPDATE: Name constraints bypass when prior CAs have only\n     excluded constraints\n     - debian/patches/CVE-2026-42011.patch: remove the empty-permitted early\n       return in name_constraints_node_list_intersect in\n       lib/x509/name_constraints.c so permitted name constraints of a\n       subsequent CA still propagate when previous CAs only carried excluded\n       constraints; also backport the upstream regression suites to\n       tests/name-constraints-merge.c\n     - CVE-2026-42011\n   * SECURITY UPDATE: Certificate validation bypass via oversized subject\n     alternative name\n     - debian/patches/CVE-2026-42013.patch: refactor the CN and DN-email\n       fallback logic and disable the fallback when\n       gnutls_x509_crt_get_subject_alt_name reports an oversized SAN\n       (GNUTLS_E_SHORT_MEMORY_BUFFER) in gnutls_x509_crt_check_hostname2 and\n       gnutls_x509_crt_check_email (lib/x509/hostname-verify.c,\n       lib/x509/email-verify.c); also backport the upstream regression tests to\n       tests/hostname-check.c and tests/cert-tests/email (with\n       tests/cert-tests/email-certs/oversized-san.pem)\n     - CVE-2026-42013\n   * SECURITY UPDATE: CN fallback not precluded by URI or SRV subject\n     alternative names\n     - debian/patches/CVE-2026-42012.patch: add GNUTLS_SAN_URI and\n       GNUTLS_SAN_OTHERNAME_SRV to the PRECLUDES_CN_FALLBACK macro in\n       lib/x509/hostname-verify.c so certificates presenting URI or SRV SANs no\n       longer allow hostname matching against the common name per RFC 6125\n       6.4.4; backport SRV virtual-SAN awareness (lib/includes/gnutls/gnutls.h.in,\n       lib/x509/common.h, lib/x509/virt-san.c, lib/x509/output.c, lib/x509/x509.c)\n       and the get_alt_name othername virtualization fix so SRV othernames are\n       recognized on 3.6.13; also backport the upstream regression tests to\n       tests/hostname-check.c\n     - CVE-2026-42012","modified":"2026-10-26T09:32:05.529947923Z","published":"2026-07-20T14:56:45Z","upstream":["CVE-2026-42011","CVE-2026-42012","CVE-2026-42013"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1784559374.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42011"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42012"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42013"}],"affected":[{"package":{"name":"gnutls-bin","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/gnutls-bin?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}},{"package":{"name":"gnutls-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/gnutls-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}},{"package":{"name":"guile-gnutls","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/guile-gnutls?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}},{"package":{"name":"libgnutls-dane0","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libgnutls-dane0?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}},{"package":{"name":"libgnutls-openssl27","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libgnutls-openssl27?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}},{"package":{"name":"libgnutls28-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libgnutls28-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}},{"package":{"name":"libgnutls30","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libgnutls30?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}},{"package":{"name":"libgnutlsxx28","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libgnutlsxx28?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.13-2ubuntu1.12+tuxcare.els6"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784559374.json"}}],"schema_version":"1.9.0"}