title: Gnutls: incomplete fix for cve-2023-5981
description: A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
problem types: Observable Discrepancy
affected:
{
product: gnutls
vendor: n/a
versions:
version: 3.8.3, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.6.16-8.el8_9.1, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:enterprise_linux:8::baseos, cpe:/a:redhat:enterprise_linux:8::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.6.16-8.el8_9.1, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:enterprise_linux:8::baseos, cpe:/a:redhat:enterprise_linux:8::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.6.16-5.el8_6.3, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:rhel_eus:8.6::baseos, cpe:/a:redhat:rhel_eus:8.6::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.6.16-7.el8_8.2, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:rhel_eus:8.8::baseos, cpe:/a:redhat:rhel_eus:8.8::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.7.6-23.el9_3.3, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:enterprise_linux:9::baseos, cpe:/a:redhat:enterprise_linux:9::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.7.6-23.el9_3.3, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/o:redhat:enterprise_linux:9::baseos, cpe:/a:redhat:enterprise_linux:9::appstream]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: affected
versions:
version: 0:3.7.6-21.el9_2.2, lessThan: *, versionType: rpm, status: unaffected
cpe: [cpe:/a:redhat:rhel_eus:9.2::appstream, cpe:/o:redhat:rhel_eus:9.2::baseos]
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:6
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: gnutls
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:7
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: gnutls
defaultStatus: affected
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.