PT-2018-10137 · Gnu+5 · Gnutls+5

Adi Shamir + 2 · Published 2018-08-22 · Updated 2024-06-15 · CVE-2018-10846

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GnuTLS (affected versions not specified)

Description A cache-based side channel in the GnuTLS implementation allows for plain text recovery in a cross-VM attack setting. An attacker can use a combination of "Just in Time" Prime+probe attack and Lucky-13 attack with crafted packets to recover plain text.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-385

Related Identifiers

ALT-PU-2020-1134

ALT-PU-2020-1224

CESA-2018_3050

CVE-2018-10846

DLA-1560-1

MGASA-2018-0435

OPENSUSE-SU-2018_2854-1

OPENSUSE-SU-2018_2958-1

OPENSUSE-SU-2024:10801-1

RHSA-2018:3050

RHSA-2018_3050

SUSE-SU-2018:2825-1

SUSE-SU-2018:2825-2

SUSE-SU-2018:2842-1

SUSE-SU-2018:2930-1

SUSE-SU-2019:14058-1

SUSE-SU-2019_14058-1

USN-3999-1

Affected Products

Alt Linux

Centos

Gnutls

Red Hat

Suse

Ubuntu

References · 94

• https://bdu.fstec.ru/vul/2020-00252 · Security Note
• https://ubuntu.com/security/CVE-2018-10845 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2825-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-1224 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10845 · Security Note
• https://bdu.fstec.ru/vul/2020-01599 · Security Note
• https://usn.ubuntu.com/3999-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3050 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0435 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10846 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:14058-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-1134 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05201 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10846 · Vendor Advisory