Description
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
References (16)
Scores
CVSS v3
7.5
EPSS
0.0095
EPSS Percentile
76.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-203
Status
published
Products (46)
fedoraproject/fedora
39
gnu/gnutls
< 3.8.3
Red Hat/Red Hat Enterprise Linux 6
Red Hat/Red Hat Enterprise Linux 7
Red Hat/Red Hat Enterprise Linux 8
0:3.6.16-8.el8_9.1
Red Hat/Red Hat Enterprise Linux 8.6 Extended Update Support
0:3.6.16-5.el8_6.3
Red Hat/Red Hat Enterprise Linux 8.8 Extended Update Support
0:3.6.16-7.el8_8.2
Red Hat/Red Hat Enterprise Linux 9
0:3.7.6-23.el9_3.3
Red Hat/Red Hat Enterprise Linux 9.2 Extended Update Support
0:3.7.6-21.el9_2.2
Red Hat/RHODF-4.15-RHEL-9
v4.15.0-10
... and 36 more
Published
Jan 16, 2024
Tracked Since
Feb 18, 2026