A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| enterprise linux | 8 | — | |
| enterprise linux | 9 | — | |
| fedoraproject | fedora | 39 | |
| gnu | gnutls | < 3.8.3 | |
| logging | 5.8 | — | |
| openshift data foundation | 4.15 | — | |
| redhat | enterprise linux | 8.0 | |
| Red Hat | Red Hat Enterprise Linux 6 | — | |
| Red Hat | Red Hat Enterprise Linux 7 | — | |
| Red Hat | Red Hat Enterprise Linux 8 | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 9 | all versions | |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | all versions | |
| Red Hat | RHODF-4.15-RHEL-9 | all versions | |
| Red Hat | RHOL-5.8-RHEL-9 | all versions | |
| rhel eus | 8.6 | — | |
| rhel eus | 8.8 | — | |
| rhel eus | 9.2 | — | |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | < V1.1 | |
| — | gnutls | 3.8.0 – < 3.8.3 |
cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:* < 3.8.3cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.