A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Vulnerable Products 6
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Debian Debian_Linux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
|
— | — |
|
Gnu Gnutls
cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*
|
— |
3.8.2
|
|
Redhat Linux
cpe:2.3:o:redhat:linux:8.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Linux
cpe:2.3:o:redhat:linux:9.0:*:*:*:*:*:*:*
|
— | — |
|
Fedoraproject Fedora
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
|
— | — |
|
Fedoraproject Fedora
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
|
— | — |
References 14
https://access.redhat.com/errata/RHSA-2024:0155
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2024:0319
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2024:0399
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2024:0451
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2024:0533
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2024:1383
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2024:2094
secalert@redhat.com
https://access.redhat.com/security/cve/CVE-2023-5981
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2248445
secalert@redhat.com
https://gnutls.org/security-new.html#GNUTLS-SA-2023-10-23
secalert@redhat.com
http://www.openwall.com/lists/oss-security/2024/01/19/3
af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2023/11/msg00016.html
af854a3a-2127-422b-91ae-364da2661108
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj…
af854a3a-2127-422b-91ae-364da2661108
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj…
af854a3a-2127-422b-91ae-364da2661108