PT-2018-2489 · Gnu+2 · Gnutls+2
Sam Fowler
·
Publicado
2018-11-30
·
Atualizado
2022-11-30
·
CVE-2018-16868
CVSS v3.1
5.6
Média
| Vetor | AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
GnuTLS versions prior to 3.6.5
Description
The issue is related to an error in verifying decrypted RSA data, allowing an attacker to potentially access protected information through a side-channel cache attack. Specifically, a Bleichenbacher type side-channel based padding oracle attack was found in the way GnuTLS handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who can run a process on the same physical core as the victim process could exploit this to extract plaintext or, in some cases, downgrade any TLS connections to a vulnerable server.
Recommendations
For GnuTLS versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing the use of TLS connections to vulnerable servers until the update can be applied.
Correção
Side Channel Attack
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Gnutls
Suse