CVE-2018-10845

moderate-risk

Published 2018-08-22

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.

Do I need to act?

0.56% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (11)

Gnutls

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

Ubuntu Linux

Fedora

Debian Linux

Affected Vendors

Debian Redhat Gnu Canonical Fedoraproject

References (20)

Third Party Advisory http://www.securityfocus.com/bid/105138

Third Party Advisory https://access.redhat.com/errata/RHSA-2018:3050

Broken Link https://access.redhat.com/errata/RHSA-2018:3505

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10845

Third Party Advisory https://eprint.iacr.org/2018/747

Patch https://gitlab.com/gnutls/gnutls/merge_requests/657

Third Party Advisory https://lists.debian.org/debian-lts-announce/2018/10/msg00022.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://usn.ubuntu.com/3999-1/