CVE-2012-0390 Information disclosure in n/a
Remote attackers can recover partial plaintext from DTLS connections via timing side-channel attacks in GnuTLS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-0390?
CVE-2012-0390 is a medium-severity vulnerability in Gnu Gnutls, published on 6 Jan 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.
Weakness: CWE-310
Which versions are affected by CVE-2012-0390?
It affects 1 product.
Products include Gnu Gnutls.
How do I fix CVE-2012-0390?
Upgrade to a fixed version.
Is CVE-2012-0390 being exploited?
There is no known exploitation of CVE-2012-0390 in the wild and no public exploit code.
Other vulnerabilities in Gnu Gnutls
Sources
Also known as DEBIAN-CVE-2012-0390, GHSA-8w6j-wjpg-446m.