IM
IronMonkey Threat Research

CVE-2024-0553 HIGH

Published: 2024-01-16 | Last Modified: 2026-03-24 | Status: Modified

Description

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Additional Descriptions (1)

Se encontró una vulnerabilidad en GnuTLS. Los tiempos de respuesta a textos cifrados con formato incorrecto en RSA-PSK ClientKeyExchange difieren de los tiempos de respuesta de textos cifrados con el relleno PKCS#1 v1.5 correcto. Este problema puede permitir que un atacante remoto realice un ataque de canal lateral de sincronización en el intercambio de claves RSA-PSK, lo que podría provocar la fuga de datos confidenciales. CVE-2024-0553 está designado como una resolución incompleta para CVE-2023-5981.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en CWE-203
[email protected] Secondary
en CWE-203

Affected Products

Vendor Product Version Update Type
gnu gnutls * <built-in method update of dict object at 0x7fd3094e5fc0> Application
fedoraproject fedora 39 <built-in method update of dict object at 0x7fd370226a80> Operating System
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7fd369c0df80> Operating System
redhat enterprise_linux 9.0 <built-in method update of dict object at 0x7fd3094e7900> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

References