CVE-2024-0553

2024-01-1600:00:00

ubuntu.com

gnutls

vulnerability

rsa-psk

data leakage

timing attack

6.3 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.8%

JSON

A vulnerability was found in GnuTLS. The response times to malformed
ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of
ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote
attacker to perform a timing side-channel attack in the RSA-PSK key
exchange, potentially leading to the leakage of sensitive data.
CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Bugs

Notes

Author	Note
iconstantin	CVE-2023-5981 ignored/fix not applied in xenial.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchgnutls28< anyUNKNOWN
ubuntu20.04noarchgnutls28< 3.6.13-2ubuntu1.10UNKNOWN
ubuntu22.04noarchgnutls28< 3.7.3-4ubuntu1.4UNKNOWN
ubuntu23.04noarchgnutls28< 3.7.8-5ubuntu1.2UNKNOWN
ubuntu23.10noarchgnutls28< 3.8.1-4ubuntu1.2UNKNOWN
ubuntu24.04noarchgnutls28< 3.8.3-1ubuntu1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	gnutls28	< any	UNKNOWN
ubuntu	20.04	noarch	gnutls28	< 3.6.13-2ubuntu1.10	UNKNOWN
ubuntu	22.04	noarch	gnutls28	< 3.7.3-4ubuntu1.4	UNKNOWN
ubuntu	23.04	noarch	gnutls28	< 3.7.8-5ubuntu1.2	UNKNOWN
ubuntu	23.10	noarch	gnutls28	< 3.8.1-4ubuntu1.2	UNKNOWN
ubuntu	24.04	noarch	gnutls28	< 3.8.3-1ubuntu1	UNKNOWN