GnuTLS Vulnerability Exposes Timing Side-Channel
CVE-2024-28834
5.3MEDIUM
Key Information:
- Vendor
- Red Hat
- Status
- Vendor
- CVE Published:
- 21 March 2024
Summary
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
Affected Version(s)
Red Hat Enterprise Linux 8 0:3.6.16-8.el8_9.3
Red Hat Enterprise Linux 8 0:3.6.16-8.el8_9.3
Red Hat Enterprise Linux 8.6 Extended Update Support 0:3.6.16-5.el8_6.4
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Collectors
NVD DatabaseMitre Database