תיאור (מקור, אנגלית)
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.
מוצרים מושפעים
gnu: gnutls; redhat: enterprise linux; debian: debian linux; fedoraproject: fedora; netapp: active iq unified manager; netapp: converged systems advisor agent; netapp: ontap select deploy administration utility
קישורים10
- gitlab.com/gnutls/gnutls/-/issues/1050 ExploitIssue TrackingVendor Advisory
- gitlab.com/gnutls/gnutls/-/issues/1050 ExploitIssue TrackingVendor Advisory
- github.com/tlsfuzzer/tlsfuzzer/pull/679 Issue TrackingPatch
- github.com/tlsfuzzer/tlsfuzzer/pull/679 Issue TrackingPatch
- access.redhat.com/security/cve/CVE-2023-0361 Third Party Advisory
- lists.debian.org/debian-lts-announce/2023/02/msg00015.html Mailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- security.netapp.com/advisory/ntap-20230324-0005/ Third Party Advisory
מדדים
- CVSS 3.1
-
7.4
HIGH
מקור הציון: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS — סבירות ניצול
- 1% אחוזון 74 · נכון ל-7 בנובמבר 2026
- CWE
- CWE-203
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.