Fixed CVE-2019-3829 and CVE-2019-3836

- Fixed CVE-2019-3829 (#1693210)
- Fixed CVE-2019-3836 (#1693214)

.gitignore

@@ -92,3 +92,13 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
 /gnutls-3.6.2.tar.xz.sig
 /gnutls-3.6.2.tar.xz
+/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
+/gnutls-3.6.2.tar.xz.sig
+/gnutls-3.6.2.tar.xz
+/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
+/gnutls-3.6.3.tar.xz.sig
+/gnutls-3.6.3.tar.xz
+/gnutls-3.6.4.tar.xz
+/gnutls-3.6.4.tar.xz.sig
+/gnutls-3.6.5.tar.xz
+/gnutls-3.6.5.tar.xz.sig

gnutls-3.6.1-disable-pss-tests.patch

@@ -1,20 +0,0 @@
-diff --git a/tests/pkcs11/tls-neg-pkcs11-key.c b/tests/pkcs11/tls-neg-pkcs11-key.c
-index c85d878..614fcea 100644
---- a/tests/pkcs11/tls-neg-pkcs11-key.c
-+++ b/tests/pkcs11/tls-neg-pkcs11-key.c
-@@ -261,6 +261,7 @@ static const test_st tests[] = {
- 	 .key = &server_ca3_key,
- 	 .exp_kx = GNUTLS_KX_ECDHE_RSA
- 	},
-+#if 0
- 	{.name = "tls1.2: rsa-sign key with rsa-pss sigs prioritized",
- 	 .pk = GNUTLS_PK_RSA,
- 	 .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA:-SIGN-ALL:+SIGN-RSA-PSS-SHA256:+SIGN-RSA-PSS-SHA384:+SIGN-RSA-PSS-SHA512:+SIGN-RSA-SHA256:+SIGN-RSA-SHA384:+SIGN-RSA-SHA512:-VERS-TLS-ALL:+VERS-TLS1.2",
-@@ -292,6 +293,7 @@ static const test_st tests[] = {
- 	 .exp_kx = GNUTLS_KX_ECDHE_RSA,
- 	 .exp_serv_err = GNUTLS_E_NO_CIPHER_SUITES
- 	},
-+#endif
- 	{.name = "tls1.2: ed25519 cert, ed25519 key", /* we cannot import that key */
- 	 .pk = GNUTLS_PK_EDDSA_ED25519,
- 	 .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA",

gnutls-3.6.4-disable-tls13.patch

@@ -0,0 +1,118 @@
+diff --git a/lib/priority.c b/lib/priority.c
+index 53c0d552d..6a4ccc2f4 100644
+--- a/lib/priority.c
++++ b/lib/priority.c
+@@ -179,7 +179,9 @@ static const int _supported_groups_secure192[] = {
+ static const int* supported_groups_secure192 = _supported_groups_secure192;
+ 
+ static const int protocol_priority[] = {
++#ifdef ENABLE_TLS13
+ 	GNUTLS_TLS1_3,
++#endif
+ 	GNUTLS_TLS1_2,
+ 	GNUTLS_TLS1_1,
+ 	GNUTLS_TLS1_0,
+diff --git a/tests/mini-x509.c b/tests/mini-x509.c
+index 52c650aa7..9b6bbcc00 100644
+--- a/tests/mini-x509.c
++++ b/tests/mini-x509.c
+@@ -258,5 +258,9 @@ void doit(void)
+ {
+ 	start("NORMAL:-VERS-ALL:+VERS-TLS1.2", 0);
+ 	start("NORMAL:-VERS-ALL:+VERS-TLS1.3", 0);
++#ifndef ENABLE_TLS13
++	start("NORMAL", 0);
++#else
+ 	start("NORMAL", 1);
++#endif
+ }
+diff --git a/tests/priorities.c b/tests/priorities.c
+index 6daef59ab..c5d44ea33 100644
+--- a/tests/priorities.c
++++ b/tests/priorities.c
+@@ -114,19 +114,27 @@ try_prio_err(const char *prio, int err)
+ void doit(void)
+ {
+ 	const int null = 3;
++#ifdef ENABLE_TLS13
+ 	int sec128_cs = 29;
+ 	int sec256_cs = 12;
+ 	int normal_cs = 29;
+ 	int pfs_cs = 23;
+ 	int null_normal_cs = 28; /* disables TLS1.3 CS */
++#else
++	int sec128_cs = 25;
++	int sec256_cs = 10;
++	int pfs_cs = 19;
++	int normal_cs = 25;
++	int null_normal_cs = normal_cs + null;
++#endif
+ 	int normal_ciphers = 7;
+ 
+ 	if (gnutls_fips140_mode_enabled()) {
+-		normal_cs = 25;
++		normal_cs = 22;
+ 		normal_ciphers = 6;
+-		pfs_cs = 25;
+-		sec256_cs = 8;
+-		sec128_cs = 25;
++		pfs_cs = 22;
++		sec256_cs = 7;
++		sec128_cs = 22;
+ 	}
+ 
+ 	try_prio("NORMAL", normal_cs, normal_ciphers, __LINE__);
+diff --git a/tests/psk-file.c b/tests/psk-file.c
+index 2512086e0..28d45560b 100644
+--- a/tests/psk-file.c
++++ b/tests/psk-file.c
+@@ -377,8 +377,13 @@ void doit(void)
+ 
+ 	run_test_ok("NORMAL:-VERS-ALL:+VERS-TLS1.2:-KX-ALL:+PSK", "jas", &key, 1, 0);
+ 	run_test_ok("NORMAL:-KX-ALL:+PSK", "jas", &key, 0, 0);
++#ifdef ENABLE_TLS13
+ 	run_test2("NORMAL:+PSK", NULL, "unknown", &key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
+ 	run_test2("NORMAL:+PSK", NULL, "jas", &wrong_key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
++#else
++	run_test2("NORMAL:+PSK", NULL, "unknown", &key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_DECRYPTION_FAILED);
++	run_test2("NORMAL:+PSK", NULL, "jas", &wrong_key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_DECRYPTION_FAILED);
++#endif
+ 	run_test2("NORMAL:-KX-ALL:+PSK", NULL, "non-hex", &key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_KEYFILE_ERROR);
+ 
+ 	run_dhtest_ok("NORMAL:-VERS-ALL:+VERS-TLS1.3:+DHE-PSK:-GROUP-EC-ALL", "jas", &key, 0, 0);
+diff --git a/tests/pskself.c b/tests/pskself.c
+index f3cc88217..65aceb252 100644
+--- a/tests/pskself.c
++++ b/tests/pskself.c
+@@ -326,9 +326,15 @@ void doit(void)
+ 	/* the following should work once we support PSK without DH */
+ 	run_test("NORMAL:-VERS-ALL:+VERS-TLS1.3:-GROUP-ALL:+PSK", 0);
+ 
++#ifdef ENABLE_TLS13
+ 	run_test("NORMAL:-KX-ALL:+PSK", 0);
+ 	run_test("NORMAL:-KX-ALL:+ECDHE-PSK", 0);
+ 	run_test("NORMAL:-KX-ALL:+DHE-PSK", 0);
++#else
++	run_test("NORMAL:-KX-ALL:+PSK", 1);
++	run_test("NORMAL:-KX-ALL:+ECDHE-PSK", 1);
++	run_test("NORMAL:-KX-ALL:+DHE-PSK", 1);
++#endif
+ 
+ 	gnutls_dh_params_deinit(dh_params);
+ }
+diff --git a/tests/session-tickets-missing.c b/tests/session-tickets-missing.c
+index 35c9045b4..69f16cf64 100644
+--- a/tests/session-tickets-missing.c
++++ b/tests/session-tickets-missing.c
+@@ -316,7 +316,11 @@ void doit(void)
+ 	start("NORMAL:-VERS-ALL:+VERS-TLS1.3", GNUTLS_NO_TICKETS);
+ 	/* ...or there is no overlap between PSK key exchange modes */
+ 	start2("NORMAL:-VERS-ALL:+VERS-TLS1.3:+PSK:-DHE-PSK", "NORMAL:-VERS-ALL:+VERS-TLS1.3", 0, 0);
++#ifdef ENABLE_TLS13
+ 	start("NORMAL", GNUTLS_NO_TICKETS);
++#else
++	start("NORMAL", 0);
++#endif
+ }
+ 
+ #endif				/* _WIN32 */

gnutls-3.6.4-no-now-guile.patch

@@ -1,7 +1,8 @@
-diff -up gnutls-3.4.2/guile/src/Makefile.in.jx gnutls-3.4.2/guile/src/Makefile.in
---- gnutls-3.4.2/guile/src/Makefile.in.jx	2015-06-16 12:23:31.000000000 -0400
-+++ gnutls-3.4.2/guile/src/Makefile.in	2015-07-02 14:01:19.415060204 -0400
-@@ -1316,7 +1316,7 @@ guileextension_LTLIBRARIES = guile-gnutl
+diff --git a/guile/src/Makefile.in b/guile/src/Makefile.in
+index 3e4f547..6ffec0e 100644
+--- a/guile/src/Makefile.in
++++ b/guile/src/Makefile.in
+@@ -1430,7 +1430,7 @@ guileextension_LTLIBRARIES = guile-gnutls-v-2.la
  # Use '-module' to build a "dlopenable module", in Libtool terms.
  # Use '-undefined' to placate Libtool on Windows; see
  # <http://lists.gnutls.org/pipermail/gnutls-devel/2014-December/007294.html>.

gnutls-3.6.5-disable-tls13-tests.patch

@@ -0,0 +1,51 @@
+--- a/tests/tls-neg-ext4-key.c	2018-11-20 20:10:57.000000000 +0100
++++ b/tests/tls-neg-ext4-key.c	2019-01-02 10:42:55.628102624 +0100
+@@ -419,6 +419,7 @@
+ 	 .cert = &server_ca3_localhost_cert,
+ 	 .key = &server_ca3_key,
+ 	 .exp_kx = GNUTLS_KX_RSA
++#ifdef ENABLE_TLS13
+ 	},
+ 	{.name = "tls1.3 ecc key",
+ 	 .pk = GNUTLS_PK_ECDSA,
+@@ -459,6 +460,7 @@
+ 	 .key = &server_ca3_eddsa_key,
+ 	 .sig = GNUTLS_SIGN_EDDSA_ED25519,
+ 	 .exp_kx = GNUTLS_KX_ECDHE_RSA,
++#endif
+ 	}
+ };
+ 
+--- a/tests/post-client-hello-change-prio.c	2018-11-18 19:53:49.000000000 +0100
++++ b/tests/post-client-hello-change-prio.c	2019-01-02 10:38:47.643311094 +0100
+@@ -125,8 +125,12 @@
+ {
+ 	override_prio = "NORMAL";
+ 	start("tls1.2-only", "NORMAL:-VERS-ALL:+VERS-TLS1.2", GNUTLS_TLS1_2);
++#ifdef ENABLE_TLS13
+ 	start("tls1.3-only", "NORMAL:-VERS-ALL:+VERS-TLS1.3", GNUTLS_TLS1_3);
+ 	start("default", "NORMAL", GNUTLS_TLS1_3);
++#else
++	start("default", "NORMAL", GNUTLS_TLS1_2);
++#endif
+ 	override_prio = "NORMAL:-VERS-ALL:+VERS-TLS1.2";
+ 	start("default overriden to TLS1.2-only", "NORMAL", GNUTLS_TLS1_2);
+ }
+--- a/tests/pkcs11/tls-neg-pkcs11-key.c	2018-12-01 06:21:11.000000000 +0100
++++ b/tests/pkcs11/tls-neg-pkcs11-key.c	2019-01-02 10:54:33.378087822 +0100
+@@ -332,6 +332,7 @@
+ 	 .cert = &server_ca3_eddsa_cert,
+ 	 .key = &server_ca3_eddsa_key,
+ 	 .exp_kx = GNUTLS_KX_ECDHE_RSA,
++#ifdef ENABLE_TLS13
+ 	},
+ 	{.name = "tls1.3: ecc key",
+ 	 .pk = GNUTLS_PK_ECDSA,
+@@ -385,6 +386,7 @@
+ 	 .cert = &server_ca3_eddsa_cert,
+ 	 .key = &server_ca3_eddsa_key,
+ 	 .exp_kx = GNUTLS_KX_ECDHE_RSA
++#endif
+ 	}
+ };
+ 

gnutls-3.6.5-fix-cve-2019-3829.patch

@@ -0,0 +1,11 @@
+--- a/lib/x509/common.c	2019-03-20 17:02:12.587726308 +0100
++++ b/lib/x509/common.c	2019-03-20 17:03:14.832169994 +0100
+@@ -1366,6 +1366,8 @@
+ 
+  cleanup:
+ 	gnutls_free(signature->data);
++	signature->data = NULL;
++	signature->size = 0;
+ 	return result;
+ }
+ 

gnutls-3.6.5-fix-cve-2019-3836.patch

@@ -0,0 +1,29 @@
+From 96e07075e8f105b13e76b11e493d5aa2dd937226 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Mon, 25 Mar 2019 16:06:39 +0100
+Subject: [PATCH] handshake: add missing initialization of local variable
+
+Resolves: #704
+
+Signed-off-by: Daiki Ueno <dueno@redhat.com>
+Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
+---
+ lib/handshake-tls13.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/handshake-tls13.c b/lib/handshake-tls13.c
+index 33ed3afa3..60f8030eb 100644
+--- a/lib/handshake-tls13.c
++++ b/lib/handshake-tls13.c
+@@ -605,6 +605,8 @@ _gnutls13_recv_async_handshake(gnutls_session_t session)
+ 		return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET);
+ 
+ 	do {
++		_gnutls_handshake_buffer_init(&hsk);
++
+ 		/* the received handshake message has already been pushed into
+ 		 * handshake buffers. As we do not need to use the handshake hash
+ 		 * buffers we call the lower level receive functions */
+-- 
+2.20.1
+

gnutls.spec

@@ -1,11 +1,21 @@
 # This spec file has been automatically updated
-Version:	3.6.2
-Release: 1%{?dist}
+Version:	3.6.5
+Release: 3%{?dist}
 Patch1:	gnutls-3.2.7-rpath.patch
-Patch2:	gnutls-3.4.2-no-now-guile.patch
-Patch3:	gnutls-3.6.1-disable-pss-tests.patch
+Patch2:	gnutls-3.6.4-no-now-guile.patch
+Patch3: gnutls-3.6.4-disable-tls13.patch
+Patch4: gnutls-3.6.5-disable-tls13-tests.patch
+Patch5:	gnutls-3.6.5-fix-cve-2019-3829.patch
+Patch6:	gnutls-3.6.5-fix-cve-2019-3836.patch
 %bcond_without dane
+%if 0%{?rhel}
+%bcond_with guile
+%bcond_without fips
+%else
 %bcond_without guile
+%bcond_without fips
+%endif
+
 Summary: A TLS protocol implementation
 Name: gnutls
 # The libraries are LGPLv2.1+, utilities are GPLv3+
@@ -15,16 +25,22 @@ BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel
 BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3
 BuildRequires: libtool, automake, autoconf, texinfo
 BuildRequires: autogen-libopts-devel >= 5.18 autogen
-BuildRequires: nettle-devel >= 3.1.1
+BuildRequires: nettle-devel >= 3.4.1
 BuildRequires: trousers-devel >= 0.3.11.2
 BuildRequires: libidn2-devel
 BuildRequires: libunistring-devel
 BuildRequires: gperf, net-tools, datefudge, softhsm
+BuildRequires: gnupg2
+%if %{with fips}
+BuildRequires: fipscheck
+%endif
+
 # for a sanity check on cert loading
 BuildRequires: p11-kit-trust, ca-certificates
 Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
+Requires: nettle >= 3.4.1
 Recommends: trousers >= 0.3.11.2
 
 %if %{with dane}
@@ -34,8 +50,8 @@ BuildRequires: unbound-devel unbound-libs
 BuildRequires: guile-devel
 %endif
 URL: http://www.gnutls.org/
-Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz
-Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz.sig
+Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz
+Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig
 Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg
 
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
@@ -136,10 +152,7 @@ This package contains Guile bindings for the library.
 %prep
 gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
 
-%setup -q
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
+%autosetup -p1
 
 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure
 rm -f lib/minitasn1/*.c lib/minitasn1/*.h
@@ -147,8 +160,15 @@ rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/
 
 echo "SYSTEM=NORMAL" >> tests/system.prio
 
+# Note that we explicitly enable SHA1, as SHA1 deprecation is handled
+# via the crypto policies
+
 %build
 %configure --with-libtasn1-prefix=%{_prefix} \
+%if %{with fips}
+           --enable-fips140-mode \
+%endif
+	   --enable-sha1-support \
            --disable-static \
            --disable-openssl-compatibility \
            --disable-non-suiteb-curves \
@@ -172,6 +192,16 @@ echo "SYSTEM=NORMAL" >> tests/system.prio
 
 make %{?_smp_mflags} V=1
 
+%if %{with fips}
+%define __spec_install_post \
+	%{?__debug_package:%{__debug_install_post}} \
+	%{__arch_install_post} \
+	%{__os_install_post} \
+	fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \
+	file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \
+%{nil}
+%endif
+
 %install
 make install DESTDIR=$RPM_BUILD_ROOT
 make -C doc install-html DESTDIR=$RPM_BUILD_ROOT
@@ -189,14 +219,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
 %check
 make check %{?_smp_mflags}
 
-%post -p /sbin/ldconfig
-
-%postun -p /sbin/ldconfig
-
-%post c++ -p /sbin/ldconfig
-
-%postun c++ -p /sbin/ldconfig
-
 %post devel
 if [ -f %{_infodir}/gnutls.info.gz ]; then
     /sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
@@ -207,21 +229,12 @@ if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then
    /sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
 fi
 
-%if %{with dane}
-%post dane -p /sbin/ldconfig
-
-%postun dane -p /sbin/ldconfig
-%endif
-
-%if %{with guile}
-%post guile -p /sbin/ldconfig
-
-%postun guile -p /sbin/ldconfig
-%endif
-
 %files -f gnutls.lang
 %defattr(-,root,root,-)
 %{_libdir}/libgnutls.so.30*
+%if %{with fips}
+%{_libdir}/.libgnutls.so.30*.hmac
+%endif
 %doc README.md AUTHORS NEWS THANKS
 %license LICENSE doc/COPYING doc/COPYING.LESSER
 
@@ -232,6 +245,10 @@ fi
 %defattr(-,root,root,-)
 %{_includedir}/*
 %{_libdir}/libgnutls*.so
+%if %{with fips}
+%{_libdir}/.libgnutls.so.*.hmac
+%endif
+
 %{_libdir}/pkgconfig/*.pc
 %{_mandir}/man3/*
 %{_infodir}/gnutls*
@@ -270,6 +287,47 @@ fi
 %endif
 
 %changelog
+* Wed Mar 27 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-3
+- Fixed CVE-2019-3829 (#1693210)
+- Fixed CVE-2019-3836 (#1693214)
+
+* Fri Jan 11 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-2
+- Add explicit Requires for nettle >= 3.4.1
+
+* Wed Jan 02 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-1
+- Updated to upstream 3.6.5 release
+- Fixed CVE-2018-16868 (#1659095)
+
+* Tue Sep 25 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-1
+- Updated to upstream 3.6.4 release
+- Added support for the latest version of the TLS1.3 protocol
+- The TLS1.3 protocol remains disabled by default
+- Enabled SHA1 support as SHA1 deprecation is handled via the
+  fedora crypto policies.
+
+* Thu Aug 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-4
+- Fixed gnutls-cli input reading
+- Ensure that we do not cause issues with version rollback detection
+  and TLS1.3.
+
+* Tue Aug 07 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-3
+- Fixed ECDSA public key import (#1612803)
+
+* Thu Jul 26 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-2
+- Backported regression fixes from 3.6.2
+
+* Mon Jul 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-1
+- Update to upstream 3.6.3 release
+
+* Wed Jun 13 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-4
+- Enable FIPS140-2 mode in Fedora
+
+* Wed Jun 06 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-3
+- Update to upstream 3.6.2 release
+
+* Fri May 25 2018 David Abdurachmanov <david.abdurachmanov@gmail.com> - 3.6.2-2
+- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep
+
 * Fri Feb 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-1
 - Update to upstream 3.6.2 release
 

sources

@@ -1,3 +1,2 @@
-SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad
-SHA512 (gnutls-3.6.2.tar.xz.sig) = a1fc8acd0b48d046eda505b774e5e1a85dce8c8b2122069e6d257a50436e989cfdbc68aa294d14f98e3fec1ade129e8bd9b67b1d02f93a7a3fde5f5acb4b70d3
-SHA512 (gnutls-3.6.2.tar.xz) = 6a574d355226bdff6198ab3f70633ff2a3cff4b5d06793bdaf19d007063bd4dd515d1bd3f331a9eb1a9ad01f83007801cfa55e5fd16c1cd3461ac33d1813fb06
+SHA512 (gnutls-3.6.5.tar.xz) = 127f053ce45c63cd745fa5a654a2d8e4fbc322f5e17dcc3740fb2e7b376dd18dad59318d66e6e93e37d6a179fca4b35cf2ae62d13be5645cd2d06badd79d4dce
+SHA512 (gnutls-3.6.5.tar.xz.sig) = 91c51442dd661bf827e7547ab88c61fb4c6683d9f90f3df7e6bab3f1b7218b69126702cfbe12d26647b477bda0746e2cfd6e5a3c10899860a42314a8a8ac15d5