CVE-2024-0553

Gnutls: incomplete fix for cve-2023-5981

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Se encontró una vulnerabilidad en GnuTLS. Los tiempos de respuesta a textos cifrados con formato incorrecto en RSA-PSK ClientKeyExchange difieren de los tiempos de respuesta de textos cifrados con el relleno PKCS#1 v1.5 correcto. Este problema puede permitir que un atacante remoto realice un ataque de canal lateral de sincronización en el intercambio de claves RSA-PSK, lo que podría provocar la fuga de datos confidenciales. CVE-2024-0553 está designado como una resolución incompleta para CVE-2023-5981.

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-01-15 CVE Reserved
2024-01-16 CVE Published
2024-09-16 CVE Updated
2024-09-16 First Exploit
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-203: Observable Discrepancy

CAPEC

References (16)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/01/19/3	Mailing List
https://lists.debian.org/debian-lts-announce/2024/02/msg00010.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2
https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html	Mailing List
https://security.netapp.com/advisory/ntap-20240202-0011

URL	Date	SRC
https://gitlab.com/gnutls/gnutls/-/issues/1522	2024-09-16

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2024:0533	2024-07-08
https://access.redhat.com/errata/RHSA-2024:0627	2024-07-08
https://access.redhat.com/errata/RHSA-2024:0796	2024-07-08
https://access.redhat.com/errata/RHSA-2024:1082	2024-07-08
https://access.redhat.com/errata/RHSA-2024:1108	2024-07-08
https://access.redhat.com/errata/RHSA-2024:1383	2024-07-08
https://access.redhat.com/errata/RHSA-2024:2094	2024-07-08
https://access.redhat.com/security/cve/CVE-2024-0553	2024-05-01
https://bugzilla.redhat.com/show_bug.cgi?id=2258412	2024-05-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				< 3.8.3 Search vendor "Gnu" for product "Gnutls" and version " < 3.8.3"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				39 Search vendor "Fedoraproject" for product "Fedora" and version "39"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				9.0 Search vendor "Redhat" for product "Enterprise Linux" and version "9.0"		-		Affected