Description
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- Debian / debian_linux10.0 – 10.0
- fedoraproject / fedora37 – 37
- fedoraproject / fedora38 – 38
- gnu / gnutls3.8.2
- RedHat / linux8.0 – 8.0
- RedHat / linux9.0 – 9.0
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:0155
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:0319
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:0399
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:0451
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:0533
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:1383
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:2094
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2023-5981
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2248445
- MISChttps://gnutls.org/security-new.html#GNUTLS-SA-2023-10-23
Updated 45m ago · 8 sources