Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2018-10846

Опубликовано: 21 авг. 2018
Источник: redhat
CVSS3: 5.3
EPSS Низкий

Описание

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.

A cache-based side channel attack was found in the way GnuTLS implements CBC-mode cipher suites. An attacker could use a combination of "Just in Time" Prime+probe and Lucky-13 attacks to recover plain text in a cross-VM attack scenario.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 5gnutlsWill not fix
Red Hat Enterprise Linux 6gnutlsWill not fix
Red Hat Enterprise Linux 8gnutlsNot affected
Red Hat Enterprise Linux 8mingw-gnutlsWill not fix
Red Hat Enterprise Linux 7gnutlsFixedRHSA-2018:305030.10.2018

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-327
https://bugzilla.redhat.com/show_bug.cgi?id=1582574gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery

EPSS

Процентиль: 2%
0.00014
Низкий

5.3 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.6
ubuntu
около 7 лет назад

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.

CVSS3: 5.6
nvd
около 7 лет назад

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.

CVSS3: 5.6
debian
около 7 лет назад

A cache-based side channel in GnuTLS implementation that leads to plai ...

CVSS3: 5.6
github
больше 3 лет назад

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.

suse-cvrf
больше 6 лет назад

Security update for gnutls

EPSS

Процентиль: 2%
0.00014
Низкий

5.3 Medium

CVSS3