CVE-2024-0553High· 7.5▾ TwilightA vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perfo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.6%
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
gnutls < 3.8.3fedora = 39enterprise_linux = 8.0enterprise_linux = 9.0Upgrade past the affected range:
gnutls 3.8.3Connected by shared product, vendor, weakness, or advisory.
CVE-2023-5981Medium· 5.9A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.
CVE-2024-0567High· 7.5A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust
CVE-2023-0361High· 7.4A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS
CVE-2024-12243Medium· 5.3Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
CVE-2024-28834Medium· 5.3A flaw was found in GnuTLS
CVE-2024-0684Medium· 5.5A flaw was found in the GNU coreutils "split" program