CVE-2023-5981Medium· 5.9▾ SunlitA vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.3%
A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.
debian_linux = 10.0gnutls < 3.8.2linux = 8.0linux = 9.0fedora = 37fedora = 38Upgrade past the affected range:
gnutls 3.8.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-0361High· 7.4A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS
CVE-2022-2509High· 7.5A vulnerability found in gnutls
CVE-2021-4209Medium· 6.5A NULL pointer dereference flaw was found in GnuTLS
CVE-2021-20231Critical· 9.8A flaw was found in gnutls
CVE-2021-20232Critical· 9.8A flaw was found in gnutls
CVE-2020-24659High· 7.5An issue was discovered in GnuTLS before 3.6.15