CVE-2018-16868
Slackware Security Advisory - gnutls Updates
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.
Se ha detectado un ataque de oráculo de relleno basado en canales laterales de tipo Bleichenbacher en la manera en la que gnutls maneja la verificación de los datos PKCS#1 v1.5 descifrados de un cifrado RSA. Un atacante que sea capaz de ejecutar un proceso en el mismo núcleo físico que el proceso víctima podría usarlo para extraer texto plano o, en algunos casos, desactualizar algunas conexiones TLS a un servidor vulnerable.
New gnutls packages are available for Slackware 14.2 and -current to fix security issues.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-11 CVE Reserved
- 2018-12-03 CVE Published
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-203: Observable Discrepancy
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://cat.eyalro.net | Technical Description | |
| http://www.securityfocus.com/bid/106080 | Third Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16868 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|