CVEvulnerability

CVE-2023-0361

7.4 HIGH Published 2023-02-15 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2023-02-15
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-203

Description

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

Affected configurations

• gnu gnutls 3.6.8-11.el8 2 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • debian debian linux 10.0 • fedoraproject fedora 36 • fedoraproject fedora 37 • fedoraproject fedora 38 • netapp active iq unified manager • netapp converged systems advisor agent • netapp ontap select deploy administration utility

Related

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References