PT-2018-2489 · Gnu+2 · Gnutls+2
Sam Fowler
·
Published
2018-11-30
·
Updated
2022-11-30
·
CVE-2018-16868
CVSS v3.1
5.6
Medium
| Vector | AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
GnuTLS versions prior to 3.6.5
Description
The issue is related to an error in verifying decrypted RSA data, allowing an attacker to potentially access protected information through a side-channel cache attack. Specifically, a Bleichenbacher type side-channel based padding oracle attack was found in the way GnuTLS handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who can run a process on the same physical core as the victim process could exploit this to extract plaintext or, in some cases, downgrade any TLS connections to a vulnerable server.
Recommendations
For GnuTLS versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing the use of TLS connections to vulnerable servers until the update can be applied.
Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Gnutls
Suse