PT-2018-2490 · Gnu+4 · Nettle+4

Sam Fowler · Published 2018-11-30 · Updated 2023-02-03 · CVE-2018-16869

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nettle (affected versions not specified)

Description The issue is related to a Bleichenbacher type side-channel based padding oracle attack in the way Nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. This could allow an attacker who is able to run a process on the same physical core as the victim process to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server. The attack exploits an error in the reverse conversion of decrypted RSA data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-310

CWE-203

Related Identifiers

ALT-PU-2018-2797

BDU:2019-00777

CVE-2018-16869

MGASA-2019-0024

OPENSUSE-SU-2018_4260-1

OPENSUSE-SU-2024:10962-1

SUSE-SU-2018:4193-1

SUSE-SU-2018_4193-1

USN-4990-1

Affected Products

Alt Linux

Linuxmint

Nettle

Suse

Ubuntu

References · 29

• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16869 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16869 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16869 · Security Note
• https://ubuntu.com/security/CVE-2021-3580 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16869 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4990-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4990-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4193-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16869 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16869 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0024 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16869 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00777 · Security Note
• https://advisories.mageia.org/MGASA-2019-0024.html · Security Note