CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8

[Andreas Stieger <astieger () suse com>]

Hello,

GnuTLS 3.3.26 and 3.5.8 were released, with the following:

https://gnutls.org/security.html#GNUTLS-SA-2017-1

It was found using the OSS-FUZZ fuzzer infrastructure that decoding a
specially crafted X.509 certificate with Proxy Certificate Information
extension present could lead to a double free. This issue was fixed in
GnuTLS 3.3.26 and 3.5.8.

https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b



https://gnutls.org/security.html#GNUTLS-SA-2017-2

It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead 
to heap and stack overflows. 

The support of OpenPGP certificates in GnuTLS is considered obsolete. As
such, it is not recommended to use OpenPGP certificates with GnuTLS.

https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a
https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732
https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a



Could CVEs please be assigned for these issues?

Thanks,
Andreas


-- 
Andreas Stieger <astieger () suse com>
Project Manager Security
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton,
HRB 21284 (AG Nürnberg)