Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 87

Export CSV
CVE-2019-3829

gnutls: use-after-free/double-free in certificate verification

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

CVSS 3.0 · 5.3 Medium EPSS 59.2% KEV · Not listed
Vendors
Fedoraproject Gnu Redhat
Products
Fedora Gnutls Enterprise Linux
CVE-2018-16868

gnutls: Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification and padding oracle verification

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu
Products
Gnutls
CVE-2018-10846

gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2018-10845

gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.

CVSS 3.1 · 5.9 Medium EPSS 3.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2018-10844

gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.

CVSS 3.1 · 5.9 Medium EPSS 3.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2015-8313

gnutls: First byte of the padding in CBC mode is not checked

GnuTLS incorrectly validates the first byte of padding in CBC modes

CVSS 3.1 · 5.9 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Gnu
Products
Debian Linux Gnutls