CVE-2024-0553
High
Description
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Gnutls
PublishedJan 16, 2024
First seenJan 16, 2024
Weakness typeCWE-203CWE-203
How to fix
Update
- gnu gnutls3.8.3 or later
Vendor advisories
- gitlab.com/gnutls/gnutls/-/issues/1522
- access.redhat.com/errata/RHSA-2024:0533
- access.redhat.com/errata/RHSA-2024:0627
- access.redhat.com/errata/RHSA-2024:0796
- access.redhat.com/errata/RHSA-2024:1082
- access.redhat.com/errata/RHSA-2024:1108
- access.redhat.com/errata/RHSA-2024:1383
- access.redhat.com/errata/RHSA-2024:2094
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu gnutls | v < 3.8.3 | 3.8.3 |
| fedoraproject fedora | 39 | — |
| redhat enterprise_linux | 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.