{"id":"CVE-2018-5407","title":"Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.","summary":"Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-200","CWE-203"],"vendor":"nodejs","product":"node.js","affected":["ubuntu_linux = 14.04","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 18.10","debian_linux = 8.0","debian_linux = 9.0","node.js < 6.14.4","node.js >= 8.0.0, < 8.11.4","node.js >= 10.0.0, < 10.9.0","openssl >= 1.0.2, < 1.0.2q","openssl >= 1.1.0, < 1.1.0i","nessus < 8.1.1","api_gateway = 11.1.2.4.0","application_server = 0.9.8","application_server = 1.0.0","application_server = 1.0.1","enterprise_manager_base_platform = 12.1.0.5.0","enterprise_manager_base_platform = 13.2.0.0.0","enterprise_manager_base_platform = 13.3.0.0.0","enterprise_manager_ops_center = 12.3.3","mysql_enterprise_backup <= 3.12.3","mysql_enterprise_backup >= 3.12.4, <= 4.1.2","peoplesoft_enterprise_peopletools = 8.55","peoplesoft_enterprise_peopletools = 8.56","peoplesoft_enterprise_peopletools = 8.57","primavera_p6_enterprise_project_portfolio_management >= 17.7, <= 17.12","primavera_p6_enterprise_project_portfolio_management = 8.4","primavera_p6_enterprise_project_portfolio_management = 15.1","primavera_p6_enterprise_project_portfolio_management = 15.2","primavera_p6_enterprise_project_portfolio_management = 16.1","primavera_p6_enterprise_project_portfolio_management = 16.2","primavera_p6_enterprise_project_portfolio_management = 18.8","tuxedo = 12.1.1.0.0","vm_virtualbox < 6.0.0","enterprise_linux_desktop = 7.0","enterprise_linux_server = 7.0","enterprise_linux_server = 7.6","enterprise_linux_server_aus = 7.6","enterprise_linux_server_eus = 7.6","enterprise_linux_server_tus = 7.6","enterprise_linux_workstation = 7.0"],"patched":["node.js 10.9.0","openssl 1.1.0i","nessus 8.1.1","vm_virtualbox 6.0.0"],"published":"2018-11-15","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:16:46.760","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-5407","references":[{"url":"http://www.securityfocus.com/bid/105897","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:0483","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:0651","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:0652","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:2125","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3932","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3933","label":"cret@cert.org"},{"url":"https://access.redhat.com/errata/RHSA-2019:3935","label":"cret@cert.org"},{"url":"https://eprint.iacr.org/2018/1060.pdf","label":"cret@cert.org"},{"url":"https://github.com/bbbrumley/portsmash","label":"cret@cert.org"},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html","label":"cret@cert.org"},{"url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","label":"cret@cert.org"},{"url":"https://security.gentoo.org/glsa/201903-10","label":"cret@cert.org"},{"url":"https://security.netapp.com/advisory/ntap-20181126-0001/","label":"cret@cert.org"},{"url":"https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%3Butm_medium=RSS","label":"cret@cert.org"},{"url":"https://usn.ubuntu.com/3840-1/","label":"cret@cert.org"},{"url":"https://www.debian.org/security/2018/dsa-4348","label":"cret@cert.org"},{"url":"https://www.debian.org/security/2018/dsa-4355","label":"cret@cert.org"},{"url":"https://www.exploit-db.com/exploits/45785/","label":"cret@cert.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"cret@cert.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"cret@cert.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"cret@cert.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","label":"cret@cert.org"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"cret@cert.org"},{"url":"https://www.tenable.com/security/tns-2018-16","label":"cret@cert.org"},{"url":"https://www.tenable.com/security/tns-2018-17","label":"cret@cert.org"},{"url":"http://www.securityfocus.com/bid/105897","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:0483","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:0651","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:0652","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:2125","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3929","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3931","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3932","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3933","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2019:3935","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://eprint.iacr.org/2018/1060.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/bbbrumley/portsmash","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201903-10","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20181126-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%3Butm_medium=RSS","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3840-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4348","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2018/dsa-4355","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/45785/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2018-16","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/security/tns-2018-17","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-5407.json"},{"url":"https://access.redhat.com/security/cve/CVE-2018-5407"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1645695"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5407"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5407"},{"url":"https://www.openssl.org/news/secadv/20181112.txt"},{"url":"https://access.redhat.com/errata/RHBA-2019:1088"},{"url":"https://access.redhat.com/errata/RHBA-2019:1053"}],"tags":["nvd","exploit-available","csaf","vex","red-hat","cve.org"],"epss":0.03418,"epssPercentile":0.88833,"exploits":{"exploitdb":true,"checkedAt":"2026-10-27T16:38:30.524Z"},"exploitAvailable":true,"ingestedAt":"2026-10-08T23:16:47.293Z","scores":{"nvd":4.7,"vendor":4.8},"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-08T21:07:44.858212Z"},"slug":"CVE-2018-5407","body":"## Overview\n\nSimultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.\n\n## Affected\n\n- `ubuntu_linux = 14.04`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 18.10`\n- `debian_linux = 8.0`\n- `debian_linux = 9.0`\n- `node.js < 6.14.4`\n- `node.js >= 8.0.0, < 8.11.4`\n- `node.js >= 10.0.0, < 10.9.0`\n- `openssl >= 1.0.2, < 1.0.2q`\n- `openssl >= 1.1.0, < 1.1.0i`\n- `nessus < 8.1.1`\n- `api_gateway = 11.1.2.4.0`\n- `application_server = 0.9.8`\n- `application_server = 1.0.0`\n- `application_server = 1.0.1`\n- `enterprise_manager_base_platform = 12.1.0.5.0`\n- `enterprise_manager_base_platform = 13.2.0.0.0`\n- `enterprise_manager_base_platform = 13.3.0.0.0`\n- `enterprise_manager_ops_center = 12.3.3`\n- `mysql_enterprise_backup <= 3.12.3`\n- `mysql_enterprise_backup >= 3.12.4, <= 4.1.2`\n- `peoplesoft_enterprise_peopletools = 8.55`\n- `peoplesoft_enterprise_peopletools = 8.56`\n- `peoplesoft_enterprise_peopletools = 8.57`\n- `primavera_p6_enterprise_project_portfolio_management >= 17.7, <= 17.12`\n- `primavera_p6_enterprise_project_portfolio_management = 8.4`\n- `primavera_p6_enterprise_project_portfolio_management = 15.1`\n- `primavera_p6_enterprise_project_portfolio_management = 15.2`\n- `primavera_p6_enterprise_project_portfolio_management = 16.1`\n- `primavera_p6_enterprise_project_portfolio_management = 16.2`\n- `primavera_p6_enterprise_project_portfolio_management = 18.8`\n- `tuxedo = 12.1.1.0.0`\n- `vm_virtualbox < 6.0.0`\n- `enterprise_linux_desktop = 7.0`\n- `enterprise_linux_server = 7.0`\n- `enterprise_linux_server = 7.6`\n- `enterprise_linux_server_aus = 7.6`\n- `enterprise_linux_server_eus = 7.6`\n- `enterprise_linux_server_tus = 7.6`\n- `enterprise_linux_workstation = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `node.js 10.9.0`\n- `openssl 1.1.0i`\n- `nessus 8.1.1`\n- `vm_virtualbox 6.0.0`\n\n## Vendor advisories\n\n- **RHSA-2019:3932** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 6 Server · released 2019-11-20 · [advisory](https://access.redhat.com/errata/RHSA-2019:3932)\n- **RHSA-2019:3929** · Red Hat · fixed in: Red Hat JBoss Web Server 5.2 for RHEL 6 Server, Red Hat JBoss Web Server 5.2 for RHEL 7 Server, Red Hat JBoss Web Server 5.2 for RHEL 8 · released 2019-11-20 · [advisory](https://access.redhat.com/errata/RHSA-2019:3929)\n- **RHSA-2019:0483** · Red Hat · fixed in: Red Hat Enterprise Linux Client (v. 7), Red Hat Enterprise Linux Client Optional (v. 7), Red Hat Enterprise Linux ComputeNode (v. 7), Red Hat Enterprise Linux ComputeNode Optional (v. 7), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7), … · released 2019-03-13 · [advisory](https://access.redhat.com/errata/RHSA-2019:0483)\n- **RHSA-2019:2125** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7) · released 2019-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2019:2125)\n- **RHSA-2019:3933** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 7 Server · released 2019-11-20 · [advisory](https://access.redhat.com/errata/RHSA-2019:3933)\n- **RHBA-2019:1088** · Red Hat · fixed in: Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts, Red Hat Virtualization 4 Hypervisor for RHEL 7 · released 2019-05-08 · [advisory](https://access.redhat.com/errata/RHBA-2019:1088)\n- **RHBA-2019:1053** · Red Hat · fixed in: Red Hat Virtualization 4 Hypervisor for RHEL 7, RHEL 7-based RHEV-H for RHEV 4 (build requirements) · released 2019-05-08 · [advisory](https://access.redhat.com/errata/RHBA-2019:1053)\n- **RHSA-2019:3935** · Red Hat · fixed in: Red Hat JBoss Core Services · released 2019-11-20 · [advisory](https://access.redhat.com/errata/RHSA-2019:3935)\n- **RHSA-2019:3931** · Red Hat · fixed in: Red Hat JBoss Web Server 5 · released 2019-11-20 · [advisory](https://access.redhat.com/errata/RHSA-2019:3931)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform 5, Red Hat JBoss Enterprise Application Platform 6, … · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-5407.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":25.9,"likelihood":0.7,"exploitation":12,"ransomware":0},"changes":[]}