CVE-2023-5981

moderate-risk
Published 2023-11-28

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

Do I need to act?

-
0.92% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (6)

Affected Vendors

Debian Redhat Gnu Fedoraproject

References (24)

Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0155
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0319
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0399
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0451
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0533
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:1383
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:2094
Vendor Advisory https://access.redhat.com/security/cve/CVE-2023-5981
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2248445
Issue Tracking https://gnutls.org/security-new.html#GNUTLS-SA-2023-10-23
Third Party Advisory http://www.openwall.com/lists/oss-security/2024/01/19/3
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0155
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0319
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0399
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0451
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:0533
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:1383
Third Party Advisory https://access.redhat.com/errata/RHSA-2024:2094
Vendor Advisory https://access.redhat.com/security/cve/CVE-2023-5981
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2248445
and 4 more references
34
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 3/34 · Minimal
Exposure 13/34 · Low