Summary
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.
Security Fix(es):
* gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | gnutls | 3.6.16-8.el8_9 |
| AlmaLinux · 8 | gnutls-c++ | 3.6.16-8.el8_9 |
| AlmaLinux · 8 | gnutls-dane | 3.6.16-8.el8_9 |
| AlmaLinux · 8 | gnutls-devel | 3.6.16-8.el8_9 |
| AlmaLinux · 8 | gnutls-utils | 3.6.16-8.el8_9 |
Vulnerabilities 1
-
Medium 5.9
Gnutls: timing side-channel in the rsa-psk authentication
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.