CVE-2024-0553
CVE-2024-0553 · Gnutls: incomplete fix for cve-2023-5981
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
CVSS 7.5 · High · EPSS 1.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 8
- Versions
- ≥ 0:3.6.16-8.el8_9.1: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 extended update support
- Versions
- ≥ 0:3.6.16-5.el8_6.3: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 extended update support
- Versions
- ≥ 0:3.6.16-7.el8_8.2: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:3.7.6-23.el9_3.3: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 extended update support
- Versions
- ≥ 0:3.7.6-21.el9_2.2: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-37: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-68: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-158: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-39: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-58: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-13: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-81: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-79: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-22: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-57: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-6: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-15: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-54: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-10: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-26: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-19: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-21: Not affected (rpm)
No fix published
rhodf-4.15-rhel-9
- Versions
- ≥ v4.15.0-103: Not affected (rpm)
No fix published
rhol-5.8-rhel-9
- Versions
- ≥ v5.8.6-22: Not affected (rpm)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2024:0533
- https://access.redhat.com/errata/RHSA-2024:0627
- https://access.redhat.com/errata/RHSA-2024:0796
- https://access.redhat.com/errata/RHSA-2024:1082
- https://access.redhat.com/errata/RHSA-2024:1108
- https://access.redhat.com/errata/RHSA-2024:1383
- https://access.redhat.com/errata/RHSA-2024:2094
- https://access.redhat.com/security/cve/CVE-2024-0553
- https://bugzilla.redhat.com/show_bug.cgi?id=2258412
- https://gitlab.com/gnutls/gnutls/-/issues/1522
- https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html
- http://www.openwall.com/lists/oss-security/2024/01/19/3
- https://lists.debian.org/debian-lts-announce/2024/02/msg00010.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/
- https://security.netapp.com/advisory/ntap-20240202-0011/
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-0553