CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

security/gnutls 3.8.13

GNU Transport Layer Security library

Port info

Maintainer
tijl@FreeBSD.org
Packages
latest: 3.8.13
Upstream
up to date
Last update
to 3.8.13 · b2662314eb
Quarterly
2026Q4: 3.8.13
Formerly
security/gnutls3 until 2014-07-22
WWW
https://gnutls.org/
Links
cgit · VuXML

Install

Package
# pkg install gnutls
installs 3.8.13 from latest; from quarterly (2026Q4) 3.8.13
Port
# cd /usr/ports/security/gnutls && make install clean
# make -C /usr/ports/security/gnutls config  # change options first
Size
2.7 MiB download · 7.7 MiB installed
Depends on
archivers/brotli 1.2.1,1, archivers/zstd 1.5.7_2, devel/gettext-runtime 1.0_1, devel/libunistring 1.4.2, dns/libidn2 2.3.8, math/gmp 6.3.0, print/indexinfo 0.3.1_1, security/libtasn1 4.21.0, security/nettle 3.10.2, security/p11-kit 0.26.5_1
License
GPLv3+ and LGPL21+
Options
6 of 8 on in the package: EXAMPLES IDN KTLS MAN3 NLS P11KIT
Show the 2 options that are off
DANE SRP

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 163.8.133.8.13–
FreeBSD 153.8.133.8.13–
FreeBSD 143.8.133.8.133.8.13

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 153.8.133.8.13–
FreeBSD 143.8.133.8.133.8.13

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 3.8.13.

Fixed (25)

Show 25 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
274610maintainer-feedback? security/gnutls: Optionise INFO and MANPAGESNew2023-10-20

Commits (248)

Sunpoet Po-Chuan Hsieh (sunpoet) · 3.6.6_1
Update dns/libidn2 to 2.1.1

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://gitlab.com/libidn/libidn2/blob/master/NEWS
dc7a01a3c8
Tijl Coosemans (tijl) · 3.6.6
Update to 3.6.6.
4ff1d1354c
Sunpoet Po-Chuan Hsieh (sunpoet) · 3.6.5_1
Update dns/libidn2 to 2.1.0

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://gitlab.com/libidn/libidn2/blob/master/NEWS
06e735460e
Tijl Coosemans (tijl) · 3.6.5
Update to 3.6.5.

PR:		234012
Exp-run by:	antoine
6cb2e16006
Baptiste Daroussin (bapt) · 3.5.19_1
Install texinfo files (GNU info) into ${PREFIX}/share/info

After a discussion on the mailing list on moving manpages to
${PREFIX}/share/man for consistency with base where it is
installed in usr/share/man, it appeared the same should happen
to GNU info files which were installed under share in base and
not in ports.

Now texinfo is not in base on any of the supported version of FreeBSD
it is possible to proceed to this move and it is easier to do than
the manpage change.

Other benefit than consistency are less patching: all build tools but
cmake are expecting info files to be under share/info and cmake (patched here)
was having an exception for BSD so the patch makes FreeBSD case less
specific for them

Bump revision of all impacted ports

PR:		232907
exp-run by:	antoine
Differential Revision:	https://reviews.freebsd.org/D17816
7990f81066
Tijl Coosemans (tijl) · 3.5.19
Update to 3.5.19.
6c4e30ccdd
Tijl Coosemans (tijl) · 3.5.18
Update to 3.5.18.
684a164fb9
Tijl Coosemans (tijl) · 3.5.17
Update to 3.5.17.
7b7e115250
Jan Beich (jbeich) · 3.5.16
security/gnutls: revert r431494 per FreeBSD 11.0 EOL

PR:		216045
Approved by:	portmgr blanket
55dbc622c9
Tijl Coosemans (tijl) · 3.5.16
Update to 3.5.16.
6736afab05
Tijl Coosemans (tijl) · 3.5.15
Update to 3.5.15.
695cfdcbf9
Tijl Coosemans (tijl) · 3.5.13
Update to 3.5.13.

MFH:		2017Q2
Security:	https://gnutls.org/security.html#GNUTLS-SA-2017-4
abe1daa077
Tijl Coosemans (tijl) · 3.5.12
Update to 3.5.12.
8fb78ac4b4
Tijl Coosemans (tijl) · 3.5.11
Update to 3.5.11.
41e4c187f1
Tijl Coosemans (tijl) · 3.5.9
Update to 3.5.9.  Disable use of libidn2 for now because it does not provide a pkgconfig file.

PR:		217073
Exp-run by:	antoine
39442f9c83
Tijl Coosemans (tijl) · 3.5.8
Make atomic operations explicit to support old gcc.

PR:		216122
d5c92c553f
Jan Beich (jbeich) · 3.5.8
security/gnutls: unbreak aarch64 after r431214

lib/accelerated/aarch64/elf/aes-aarch64.s.tmp.S:5:1: error: unknown directive
.arch armv8-a+crypto
^
lib/accelerated/aarch64/elf/aes-aarch64.s.tmp.S:49:2: error: instruction requires: crypto
 aese v6.16b,v0.16b
 ^

PR:		216045
Approved by:	tijl (maintainer)
ce32977b20
Tijl Coosemans (tijl) · 3.5.8
Update to 3.5.8.

PR:		215909
Submitted by:	brnrd
Exp-run by:	antoine
MFH:		2017Q1
Security:	0c5369fc-d671-11e6-a9a5-b499baebfeaf
8320e35f01
Tijl Coosemans (tijl) · 3.4.17
Update to 3.4.17 and pass the right dlopen path for libtspi to configure.
ce97a4e2eb
Tijl Coosemans (tijl) · 3.4.16
Update to 3.4.16.
ddb6e50888
Joseph Mingrone (jrm) · 3.4.15
Add math/gmp to LIB_DEPENDS

Q/A warned that bin/certtool was linked to lib/libgmps.so.10

Approved by:	swills (mentor) tijl (maintainer)
Differential Revision:	https://reviews.freebsd.org/D8153
dda91049fe
Dmitry Marakasov (amdmi3) · 3.4.15
Most commonly used build systems support silent builds, when they hide actual commands executed and only show short summary line (like "CC foo.c"). CMake and ninja enable this by default, some autotools using ports do as well. This is unacceptable because we need complete build logs at any time, so we now switch to verbose build logs unconditionally. Note that this change deliberately affects ALL 

Change summary:

- Always do verbose builds for cmake, ninja and GNU configure (the
  latter includes check if --disable-silent-rules is actually supported
  by the configure script; there are isolated cases when it's not true)
- Remove CMAKE_VERBOSE, NINJA_VERBOSE and
  CONFIGURE_ARGS=--disable-silent-rules from all ports which set them
  for this is no longer needed
- Revert hacks for --disable-silent-rules support priorly committed
  to biology/ncbi-blast+ and net-p2p/mldonkey - no longer needed as well

Submitted by:	amdmi3
Reviewed by:	mat
Exp-run by:	antoine
Approved by:	portmgr (mat, antoine)
Differential Revision:	D7534
30a00f2227
Tijl Coosemans (tijl) · 3.4.15
Update to 3.4.15.

MFH:		2016Q3
Security:	https://gnutls.org/security.html#GNUTLS-SA-2016-3
c4d44c3384
Tijl Coosemans (tijl) · 3.4.14
Update to 3.4.14.
9ce5be358c
Tijl Coosemans (tijl) · 3.4.13
Update to 3.4.13.
c381f0cff0
Tijl Coosemans (tijl) · 3.4.12
Update to 3.4.12.

libpkcs11mock1.so is commented out in pkg-plist because it is part of the
testsuite and shouldn't be installed.  This has been fixed upstream.
6b4ee6265f
Tijl Coosemans (tijl) · 3.4.11
Update to 3.4.11.
7c1fdb56cd
Mathieu Arnold (mat) · 3.4.10
Remove ${PORTSDIR}/ from dependencies, categories r, s, t, and u.

With hat:	portmgr
Sponsored by:	Absolight
597afc47ba
Tijl Coosemans (tijl) · 3.4.10
- Update security/gnutls to 3.4.10. - Rename the LIBDANE option DANE because that's the name of the protocol   supported by libgnutls-dane and gnutls-cli.  Also clarify the option   description. - Add an IDN option. - libgnutls-openssl has been removed in 3.4.  Some ports used this library   in their LIB_DEPENDS but no port actually required it. - Some old API functions have been removed.  Ports t

net-im/jabber: This port used the old API to give users fine grained
control over which crypto algorithms were used via a configuration file.
It's not immediately obvious how to port this to the new API so the port
always uses the defaults now.

www/hydra: Mark BROKEN.  This uses more removed calls than the other ports,
is said to be alpha quality and not fully functional and has been abandoned
10 years ago.

PR:		207768
Exp-run by:	antoine
Approved by:	portmgr (antoine)
6bc6f3a9e0
Tijl Coosemans (tijl) · 3.3.17.1_3
- Take maintainer. - Fix a build problem with upcoming libc++.

PR:		207768, 208175
Approved by:	bdrewery (maintainer)
eaeb84f225
Olli Hauer (ohauer) · 3.3.17.1_3
- bump PORTREVISION on ports depending on unbound

PR:		207948
Submitted by:	jaap@NLnetLabs.nl (maintainer)
98bbb468b4
Erwin Lansing (erwin) · 3.3.17.1_2
- Update unbound to 1.5.7 - Bump PORTREVISIOn on dependent ports

Some Upgrade Notes:

This release fixes a validation failure for nodata with wildcards and
emptynonterminals. Fixes OpenSSL Library compability. Fixes correct
response for malformed EDNS queries. For crypto in libunbound there is
libnettle support.

Qname minimisation is implemented. Use qname-minimisation: yes to
enable it. This version sends the full query name when an error is
found for intermediate names. It should therefore not fail for names
on nonconformant servers. It combines well with
harden-below-nxdomain: yes because those nxdomains are probed by the
qname minimisation, and that will both stop privacy sensitive traffic
and reduce nonsense traffic to authority servers. So consider
enabling both. In this implementation IPv6 reverse lookups add
several labels per increment, because otherwise those lookups would be
very slow. [ Reference
https://tools.ietf.org/html/draft-ietf-dnsop-qname-minimisation-08 ]

More details at <http://unbound.net>

PR:		206347
Submitted by:	Jaap Akkerhuis <jaap@NLnetLabs.nl>
Approved by:	maintainer timeout
Sponsored by:	DK Hostmaster A/S
d140eabacb
Johan van Selst (johans) · 3.3.17.1_1
Bump versions to chase Nettle shared library update
c590f0bad9
Mark Felder (feld) · 3.3.17.1
Update MASTER_SITES to fix fetching problem due to abnormal version number

PR:		202332
f26ac585a3
Mark Felder (feld) · 3.3.17.1
- Update to 3.3.17.1

MFH:		2015Q3
Relnotes:	http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8268
Security:	ec6a2a1e-429d-11e5-9daa-14dae9d210b8
ce0db51f73
Bryan Drewery (bdrewery) · 3.3.16
- Update to 3.3.16

Changes: http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/8235
240ae04027
Xin LI (delphij) · 3.3.15
Fix plist when LIBDANE is defined (PORTREVISION not bumped because package wouldn't be successful in the case).

Pointy hat to:	delphij
Reported by:	sunpoet
MFH:		2015Q2
ec497b127a
Xin LI (delphij) · 3.3.15
Update to 3.3.15.

PR:		198875
Approved by:	maintainer
d63f3ad8aa
Bryan Drewery (bdrewery) · 3.2.21_1
GnuTLS tries to use /usr/local/share/certs/ca-root-nss.crt. Instead of maybe using it if it is already installed or if the P11KIT option is selected (which depends on ca_root_nss), just always depend on ca_root_nss.

Reported by:	Tatsuki Makino
309c1749fe
Bryan Drewery (bdrewery) · 3.2.21
Add CPE information.

PR:		153859
Submitted by:	shun <shun.fbsd.pr@dropcut.net>
ab78a380b2
Tijl Coosemans (tijl) · 3.2.21
Update gnutls to 3.2.21

PR:		196400
Approved by:	bdrewery (maintainer)
0e5fce20c9
Dmitry Marakasov (amdmi3) · 3.2.19_1
- Fix plist for LIBDANE option

Approved by:	portmgr blanket
8846a09bfa
Bryan Drewery (bdrewery) · 3.2.19
Fix build on systems without stdnoreturn.h

Reported by:	many
745d6e04b6
Bryan Drewery (bdrewery) · 3.2.19
- Update to 3.2.19
098c7e1322
Bryan Drewery (bdrewery) · 3.2.18
Update to 3.2.18
b455206d28
Tijl Coosemans (tijl) · 3.2.16_5
dns/libidn: - Add USES=libtool and bump dependent ports - Add INSTALL_TARGET=install-strip - Always install libidn-components.png because it is used by libidn.info - Add -lintl to Libs.private instead of Libs in libidn.pc
f1655c7b7a
Dmitry Marakasov (amdmi3) · 3.2.16_4
- Switch dns/unbound to USES=libtool, drop .la files - Bump dependent ports as .so version has changed - While here, add LICENSE_FILE to dns/getdns

Approved by:	portmgr blanket
13ab9a72d8
Kubilay Kocak (koobs) · 3.2.16_3
security/gnutls: Support OPTIONal library dependencies

Factor out libidn, libp11-kit and libtspi into OPTIONal library
dependencies, with the CRYWRAP, P11KIT and TPM options respectively, as per
the upstream documentation [1].

Make ZLIB an OPTION because we can, and the choice to customise
compression support in security software (especially lately) may be
very useful for some consumers.

Add CRYWRAP, P11KIT, TPM and ZLIB to OPTIONS_DEFAULT to retain current
default functionality.

[1] http://gnutls.org/manual/html_node/Downloading-and-installing.html

Inspired by:	Recent gnutls 2 -> 3 change, fan of minimal dependencies

PR:		192090
Submitted by:	koobs
Approved by:	maintainer
5883d2a2c8
Roman Bogorodskiy (novel) · 3.2.16_2
- Update security/libtasn1 to 4.0 - Add USES= libtool and set INSTALL_TARGET to install-strip - Drop useless bsd.port.options.mk include - Bump PORTREVISION of ports that depend on libtasn1 as   shlib version has changed - Add an UPDATING entry for that

Exp-run by:	antoine
32290f6fc6
Bryan Drewery (bdrewery) · 3.2.16_1
- Fix plist

Reported by:	many
921f399be2