Summary
[3.6.16-8]
- timing side-channel in the RSA-PSK authentication (CVE-2023-5981)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | gnutls | 0:3.6.16-8.el8_9 |
| Oracle Linux · 8 | gnutls-c++ | 0:3.6.16-8.el8_9 |
| Oracle Linux · 8 | gnutls-dane | 0:3.6.16-8.el8_9 |
| Oracle Linux · 8 | gnutls-devel | 0:3.6.16-8.el8_9 |
| Oracle Linux · 8 | gnutls-utils | 0:3.6.16-8.el8_9 |
Vulnerabilities 1
-
Medium 5.9
Gnutls: timing side-channel in the rsa-psk authentication
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.