A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message the attacker would be able to decrypt the application data exchanged over that connection.

🗓️ 20 Feb 2023 08:00:00Reported by MicrosoftType

A timing side-channel in GnuTLS RSA ClientKeyExchange enables Bleichenbacher style key recovery.

Reporter	Title	Published	Views	Family All 166
FreeBSD	GnuTLS -- timing sidechannel in RSA decryption	10 Feb 202300:00	–	freebsd
FreeBSD	MySQL -- Multiple vulnerabilities	18 Jul 202300:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to GnuTLS information disclosure vulnerability( CVE-2023-0361)	6 Jul 202318:03	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for May 2023	26 Jun 202316:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	26 May 202314:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	12 Sep 202319:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from libcurl, openssl, gnutls, libarchive and libsepol	19 Jun 202312:14	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.10 addresses multiple security vulnerabilities.	27 Sep 202321:11	–	ibm