Lucene search

F5F5:K000138649

HistoryFeb 21, 2024 - 12:00 a.m.

K000138649 : GnuTLS vulnerabilities CVE-2023-5981 and CVE-2024-0553

2024-02-2100:00:00

my.f5.com

vulnerability

gnutls

rsa-psk

timing

confidentiality

exploit

internal operations

software

6.8 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.0%

JSON

Security Advisory Description

CVE-2023-5981

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

CVE-2024-0553

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Impact

Attackers can exploit variations in timing to indirectly infer certain details about the function’s internal operations, impacting confidentiality.

CPENameOperatorVersion
big-ip next central managereq20.0.1
big-ip next central managereq20.0.2
big-ip next central managereq20.1.0
big-ip next cgnat cnfeq1.1.0
big-ip next cgnat cnfeq1.1.1
big-ip next cgnat cnfeq1.2.0
big-ip next cgnat cnfeq1.2.1
big-ip next cgnat cnfeq1.3.0
big-ip next dns cnfeq1.1.0
big-ip next dns cnfeq1.1.1

Name	Operator	Version
big-ip next central manager	eq	20.0.1
big-ip next central manager	eq	20.0.2
big-ip next central manager	eq	20.1.0
big-ip next cgnat cnf	eq	1.1.0
big-ip next cgnat cnf	eq	1.1.1
big-ip next cgnat cnf	eq	1.2.0
big-ip next cgnat cnf	eq	1.2.1
big-ip next cgnat cnf	eq	1.3.0
big-ip next dns cnf	eq	1.1.0
big-ip next dns cnf	eq	1.1.1

Rows per page:

1-10 of 4241