Gnutls: incomplete fix for cve-2023-5981
Summary
| CVE | CVE-2024-0553 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-16 12:15:45 UTC |
| Updated | 2026-10-15 01:17:17 UTC |
| Description | A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-203 | CWE-203 Observable Discrepancy
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | [email protected] | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 39 | All | All | All |
| Application | Gnu | Gnutls | All | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:3.6.16-8.el8_9.1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:3.6.16-8.el8_9.1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | unaffected 0:3.6.16-5.el8_6.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | unaffected 0:3.6.16-7.el8_8.2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.7.6-23.el9_3.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:3.7.6-23.el9_3.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:3.7.6-21.el9_2.2 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-37 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-68 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-39 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-58 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-13 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-81 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-79 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-22 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-57 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-6 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-15 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-15 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-54 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-10 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-26 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-19 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-158 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-21 * rpm | Not specified |
| CNA | Red Hat | RHODF-4.15-RHEL-9 | unaffected v4.15.0-103 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-22 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-11 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v6.8.1-407 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-19 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v1.0.0-479 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-7 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.4.0-247 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-5 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v1.1.0-227 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.1-470 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v2.9.6-14 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-2 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-24 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v5.8.6-10 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.1.0-525 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.1.0-224 * rpm | Not specified |
| CNA | Red Hat | RHOL-5.8-RHEL-9 | unaffected v0.28.1-56 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| ADP | Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux Subsystem | affected V1.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 2258412 – (CVE-2024-0553) CVE-2024-0553 gnutls: incomplete fix for CVE-2023-5981 | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| cve-details | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2024:1383 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0796 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:1082 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| January 2024 GnuTLS Vulnerabilities in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| GnuTLS has incomplete fix for CVE-2023-5981 (#1522) · Issues · gnutls / GnuTLS · GitLab | af854a3a-2127-422b-91ae-364da2661108 | gitlab.com | Exploit, Issue Tracking, Vendor Advisory |
| Red Hat | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2094 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.debian.org/debian-lts-announce/2024/02/msg00010.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| oss-security - GnuTLS 3.8.3 released, fixes CVE-2024-0553 & CVE-2024-0567 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Red Hat | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [SECURITY] Fedora 39 Update: gnutls-3.8.3-1.fc39 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| cert-portal.siemens.com/productcert/html/ssa-794697.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| access.redhat.com/errata/RHSA-2024:1108 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [gnutls-help] gnutls 3.8.3 | af854a3a-2127-422b-91ae-364da2661108 | lists.gnupg.org | Mailing List |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2024-01-15T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2024-01-16T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 161333 Oracle Enterprise Linux Security Update for gnutls (ELSA-2024-0627)
- 161336 Oracle Enterprise Linux Security Update for gnutls (ELSA-2024-0533)
- 161337 Oracle Enterprise Linux Security Update for gnutls (ELSA-2024-12135)
- 200059 Ubuntu Security Notification for GnuTLS Vulnerabilities (USN-6593-1)
- 242766 Red Hat Update for libssh (RHSA-2024:0538)
- 242768 Red Hat Update for gnutls (RHSA-2024:0533)
- 242813 Red Hat Update for gnutls (RHSA-2024:0627)
- 242921 Red Hat Update for gnutls (RHSA-2024:0796)
- 243014 Red Hat Update for gnutls (RHSA-2024:1082)
- 243040 Red Hat Update for gnutls (RHSA-2024:1108)
- 284905 Fedora Security Update for gnutls (FEDORA-2024-c43a6cc3f8)
- 285017 Fedora Security Update for gnutls (FEDORA-2024-80428c408c)
- 357304 Amazon Linux Security Advisory for gnutls : ALAS2023-2024-548
- 510684 Alpine Linux Security Update for gnutls
- 6000492 Debian Security Update for gnutls28 (DLA 3740-1)
- 673536 EulerOS Security Update for gnutls (EulerOS-SA-2024-1312)
- 673852 EulerOS Security Update for gnutls (EulerOS-SA-2024-1213)
- 673958 EulerOS Security Update for gnutls (EulerOS-SA-2024-1235)
- 674090 EulerOS Security Update for gnutls (EulerOS-SA-2024-1334)
- 674138 EulerOS Security Update for gnutls (EulerOS-SA-2024-1507)
- 674140 EulerOS Security Update for gnutls (EulerOS-SA-2024-1486)
- 755964 SUSE Enterprise Linux Security Update for gnutls (SUSE-SU-2024:0860-1)
- 941558 AlmaLinux Security Update for gnutls (ALSA-2024:0533)
- 941562 AlmaLinux Security Update for gnutls (ALSA-2024:0627)
- 961116 Rocky Linux Security Update for gnutls (RLSA-2024:0627)