Lucene search

K
mageiaGentoo FoundationMGASA-2024-0089
HistoryMar 26, 2024 - 11:00 a.m.

Updated gnutls packages fix security vulnerabilities

2024-03-2611:00:24
Gentoo Foundation
advisories.mageia.org
21
gnutls
minerva attack
cryptographic vulnerability
side-channel leaks
gnutls_privkey_flag_reproducible
nonce size
timing side-channel
cve-2024-28834
application crash
certificate verification
certtool --verify-chain
cve-2024-28835
unix

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0

Percentile

13.8%

The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel. (CVE-2024-28834) A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the “certtool --verify-chain” command. (CVE-2024-28835)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchgnutls< 3.8.4-1gnutls-3.8.4-1.mga9

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0

Percentile

13.8%