CVE-2022-2509

Name	CVE-2022-2509
Description	A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3070-1, DSA-5203-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gnutls28 (PTS)	buster	3.6.7-4+deb10u8	vulnerable
	buster (security)	3.6.7-4+deb10u12	fixed
	bullseye	3.7.1-5+deb11u4	fixed
	bullseye (security)	3.7.1-5+deb11u3	fixed
	bookworm	3.7.9-2+deb12u2	fixed
	sid, trixie	3.8.5-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
gnutls28	source	buster	3.6.7-4+deb10u9	DLA-3070-1
gnutls28	source	bullseye	3.7.1-5+deb11u2	DSA-5203-1
gnutls28	source	(unstable)	3.7.7-1

Notes

https://gnutls.org/security-new.html#GNUTLS-SA-2022-07-07
https://gitlab.com/gnutls/gnutls/-/issues/1383 (restricted)
https://gitlab.com/gnutls/gnutls/-/commit/ce37f9eb265dbe9b6d597f5767449e8ee95848e2