This updates gnutls to the latest upstream release. Notable changes are:
This also fixes 4 CVEs (CVE-2025-32989, CVE-2025-6395, CVE-2025-32988, and CVE-2025-32990).
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2025-16a24364cePlease log in to add feedback.
This update has been submitted for testing by ueno.
This update's test gating status has been changed to 'waiting'.
ueno edited this update.
This update's test gating status has been changed to 'passed'.
Was it your intention that we should be able to use the new key formats now, by default? If so, do we need additional configuration or policy changes? With the crypto policy set to NEXT:TEST-PQ on Fedora 42 with crypto-policies 20250707-1.gitad370a8, I can only connect to ports 6000-6003 and 6036-6039 of https://test.openquantumsafe.org/, using the CA.crt found there (https://test.openquantumsafe.org/CA.crt ) and:
echo "GET /" | gnutls-cli -V --x509cafile=CA.crt -p ${port_number} "test.openquantumsafe.org"
when I'd expect to be able to connect to more -- for example, port 6188 with ML-DSA-44 and a choice of other algorithms gives me:
In comparison, if I instead use openssl-3.2.4-3 and oqsprovider-0.8.0-3 with "echo "GET /" | openssl s_client -CAfile CA.crt -connect "test.openquantumsafe.org:${port_number}" -curves ... , with the curves argument derived from https://test.openquantumsafe.org/assignments.json as described at https://test.openquantumsafe.org/, I can connect to ports 6000-6003, 6036-6039, 6072-6074, 6087, 6096-6098, 6111, 6120-6122, 6135-6137, 6150-6152, 6165-6166, 6179, 6188-6190, 6203-6204, 6217, 6226-6228, 6241-6243, 6256-6257, 6270-6272, 6285, 6294, 6303-6305, 6318-6320, 6333-6334, 6347, 6356-6358, 6371-6373, 6386, 6395-6397, 6410-6412, 6425-6427, 6440-6442, 6455-6456, 6469, 6478-6480, 6493-6495, 6508-6509, 6522, 6531-6533, 6546-6548, 6561-6562, 6575-6577, 6590-6592, 6605-6607, 6620-6622, 6635-6637, 6650-6652, 6665-6666, 6679-6681, 6694-6696, 6709-6711, 6724-6726, 6739-6741, and 6754-6756. Obviously, I wouldn't expect to match this with gnutls, which supports fewer algorithms, but shouldn't gnutls 3.8.10 be able to connect to more of these ports? Is this a problem with interoperability? With configuration? Or have I overlooked something?
This update has been pushed to testing.
Works
Works.
This update can be pushed to stable now if the maintainer wishes
Works great! LGTM! =)
This update has been submitted for stable by bodhi.
This update has been pushed to stable.
@cmorris afaik crypto-policies needs some update too, but the key format change doesn't affect the connecting scenarios (unless you are using client authentication), because it is only about private keys.