7.4

CVE-2023-0361

Exploit

EPSS 1.4%
Veröffentlicht 15.02.2023 18:15:11
Zuletzt bearbeitet 19.03.2025 18:15:18
Erkennungen
Login

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 12

NVD 10 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Gnu ≫ Gnutls Version 3.6.8-11.el8_2

Redhat ≫ Enterprise Linux Version 8.0

Redhat ≫ Enterprise Linux Version 9.0

Debian ≫ Debian Linux Version 10.0

Fedoraproject ≫ Fedora Version 36

Fedoraproject ≫ Fedora Version 37

Fedoraproject ≫ Fedora Version 38

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Converged Systems Advisor Agent Version -

Netapp ≫ Ontap Select Deploy Administration Utility Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.4%	0.69

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.4	2.2	5.2	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA-ADP	7.4	2.2	5.2	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

https://access.redhat.com/security/cve/CVE-2023-0361

Third Party Advisory

https://github.com/tlsfuzzer/tlsfuzzer/pull/679

Patch

Issue Tracking

https://gitlab.com/gnutls/gnutls/-/issues/1050

Vendor Advisory

Exploit

Issue Tracking

https://lists.debian.org/debian-lts-announce/2023/02/msg00015.html

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFIA3X4IZ3CW7SRQ2UHNHNPMRIAWF2FI/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS4KVDOG6QTALWHC2QE4Y7VPDRMLTRWQ/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z634YBXAJ5VLDI62IOPBVP5K6YFHAWCY/

https://security.netapp.com/advisory/ntap-20230324-0005/

Third Party Advisory

https://security.netapp.com/advisory/ntap-20230725-0005/

https://nvd.nist.gov/vuln/detail/CVE-2023-0361

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-0361

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-0361

EUVD