Red Hat: CVE-2024-0553: gnutls: incomplete fix for CVE-2023-5981 (Multiple Advisories)
Description
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
Solution(s)
- redhat-upgrade-gnutls
- redhat-upgrade-gnutls-c
- redhat-upgrade-gnutls-c-debuginfo
- redhat-upgrade-gnutls-dane
- redhat-upgrade-gnutls-dane-debuginfo
- redhat-upgrade-gnutls-debuginfo
- redhat-upgrade-gnutls-debugsource
- redhat-upgrade-gnutls-devel
- redhat-upgrade-gnutls-utils
- redhat-upgrade-gnutls-utils-debuginfo
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center