p PatchFirst

CVE-2018-16868

CVE-2018-16868

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

CVSS 4.7 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gnutls

    Versions
    • n/a: Affected

    No fix published

  • gnutls28 Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.6.5-2

    Update to 3.6.5-2

  • gnutls28 Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.6.5-2

    Update to 3.6.5-2

  • gnutls28 Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.6.5-2

    Update to 3.6.5-2

  • gnutls26 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.12.23-1ubuntu4
    • 2.12.23-1ubuntu5
    • 2.12.23-12ubuntu1
    • 2.12.23-12ubuntu2
    • 2.12.23-12ubuntu2.1
    • 2.12.23-12ubuntu2.2
    • 2.12.23-12ubuntu2.3
    • 2.12.23-12ubuntu2.4
    • 2.12.23-12ubuntu2.5
    • 2.12.23-12ubuntu2.6
    • 2.12.23-12ubuntu2.7
    • 2.12.23-12ubuntu2.8
    • 2.12.23-12ubuntu2.10+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnutls28 Ubuntu:Pro:16.04:LTS

    Versions
    • 3.3.15-5ubuntu2
    • 3.3.18-1ubuntu1
    • 3.3.20-1ubuntu1
    • 3.4.9-2ubuntu1
    • 3.4.10-4ubuntu1
    • 3.4.10-4ubuntu1.1
    • 3.4.10-4ubuntu1.2
    • 3.4.10-4ubuntu1.3
    • 3.4.10-4ubuntu1.4
    • 3.4.10-4ubuntu1.5
    • 3.4.10-4ubuntu1.6
    • 3.4.10-4ubuntu1.7
    • 3.4.10-4ubuntu1.8
    • 3.4.10-4ubuntu1.9
    • 3.4.10-4ubuntu1.9+esm1
    • 3.4.10-4ubuntu1.9+esm2
    • 3.4.10-4ubuntu1.9+esm3
    • 3.4.10-4ubuntu1.9+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnutls28 Ubuntu:Pro:18.04:LTS

    Versions
    • 3.5.8-6ubuntu3
    • 3.5.17-1ubuntu1
    • 3.5.17-1ubuntu3
    • 3.5.18-1ubuntu1
    • 3.5.18-1ubuntu1.1
    • 3.5.18-1ubuntu1.2
    • 3.5.18-1ubuntu1.3
    • 3.5.18-1ubuntu1.4
    • 3.5.18-1ubuntu1.5
    • 3.5.18-1ubuntu1.6
    • 3.5.18-1ubuntu1.6+esm1
    • 3.5.18-1ubuntu1.6+esm2
    • 3.5.18-1ubuntu1.6+esm3
    • 3.5.18-1ubuntu1.6+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →