CVE-2023-0361 Information disclosure in gnutls
A timing side-channel in GnuTLS allows attackers to recover RSA keys and decrypt application data via Bleichenbacher-style attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0361?
CVE-2023-0361 is a high-severity vulnerability in Debian Debian Linux, published on 15 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.
Weakness: CWE-203
Which versions are affected by CVE-2023-0361?
It affects 7 products.
Linux distribution packages (40)
gnutls AlmaLinux:8 | All versions | 3.6.16-6.el8_7 |
gnutls-c++ AlmaLinux:8 | All versions | 3.6.16-6.el8_7 |
gnutls-dane AlmaLinux:8 | All versions | 3.6.16-6.el8_7 |
gnutls-devel AlmaLinux:8 | All versions | 3.6.16-6.el8_7 |
gnutls-utils AlmaLinux:8 | All versions | 3.6.16-6.el8_7 |
gnutls AlmaLinux:9 | All versions | 3.7.6-18.el9_1 |
gnutls-c++ AlmaLinux:9 | All versions | 3.7.6-18.el9_1 |
gnutls-dane AlmaLinux:9 | All versions | 3.7.6-18.el9_1 |
gnutls-devel AlmaLinux:9 | All versions | 3.7.6-18.el9_1 |
gnutls-utils AlmaLinux:9 | All versions | 3.7.6-18.el9_1 |
gnutls-c++ Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-c++-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-dane Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-dane-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-utils Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.16-6.el8_7 |
gnutls Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.16-6.el8_7 |
gnutls-c++-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.16-6.el8_7 |
gnutls-dane-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.16-6.el8_7 |
gnutls-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.16-6.el8_7 |
gnutls-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.16-6.el8_7 |
gnutls-utils-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.16-6.el8_7 |
gnutls-c++ Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-c++-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-dane Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-dane-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-utils Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls-utils-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:3.7.6-18.el9_1 |
gnutls Red Hat:enterprise_linux:9::baseos | All versions | 0:3.7.6-18.el9_1 |
gnutls-c++-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.7.6-18.el9_1 |
gnutls-dane-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.7.6-18.el9_1 |
gnutls-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.7.6-18.el9_1 |
gnutls-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:3.7.6-18.el9_1 |
gnutls-utils-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:3.7.6-18.el9_1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Gnu Gnutls, Netapp Active Iq Unified Manager, Netapp Converged Systems Advisor Agent, Netapp Ontap Select Deploy Administration Utility and 1 more.
How do I fix CVE-2023-0361?
Upgrade to a fixed version.
Is CVE-2023-0361 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0361 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2023-0361, ALSA-2023:1141, ALSA-2023:1569, AZL-13568, CLSA-2023-1692294262, CLSA-2023-1692295113 and 17 more.