Name: CVE-2018-10844: Covert Timing Channel
Creator: Rapid7
Published: 2018-08-22T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-10844, CWE-385, CWE-327, CVSS 5.9, EPSS 0.00194

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.

CVSS Details

CVSS 3.1 Base Score: 5.9
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon Linux Ami 2	—	Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-debuginfoUpgrade gnutls	Apr 27, 2020	Aug 22, 2018
Centos_linux	—	Upgrade gnutls-develUpgrade gnutls-debuginfoUpgrade gnutls-c++Upgrade gnutls-daneUpgrade gnutlsUpgrade gnutls-utils	Aug 28, 2019	Aug 22, 2018
Debian	—	Upgrade gnutls28	Feb 19, 2019	Aug 22, 2018
Huawei Euleros 2_0_sp2	—	Upgrade gnutls-utilsUpgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-develUpgrade gnutls-dane	Dec 31, 2018	Aug 22, 2018
Huawei Euleros 2_0_sp3	—	Upgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls	Feb 15, 2019	Aug 22, 2018
Huawei Euleros 2_0_sp5	—	Upgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutls-c++Upgrade gnutls-devel	Jan 9, 2019	Aug 22, 2018
Oracle_linux	—	Upgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-develUpgrade gnutls-dane	Nov 6, 2018	Aug 21, 2018
Redhat_linux	—	Upgrade gnutls-utilsNo solution existsUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-debuginfoUpgrade gnutls-develUpgrade gnutls-dane	Oct 31, 2018	Aug 22, 2018
Suse	—	Upgrade libgnutls30-hmac-32bitUpgrade libgnutls-openssl27Upgrade libgnutls30Upgrade libgnutls-dane0Upgrade libgnutls-dane-develUpgrade libgnutls30-32bitUpgrade libgnutlsxx-develUpgrade libgnutlsxx28Upgrade libgnutls-openssl-develUpgrade gnutlsUpgrade gnutls-guileUpgrade libgnutls30-hmacUpgrade libgnutls-devel-32bitUpgrade libgnutls-develUpgrade libgnutls28-32bitUpgrade libgnutls28	Sep 25, 2018	Aug 22, 2018
Ubuntu	—	Upgrade libgnutls30	May 31, 2019	Aug 22, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business