Medium severity · published Aug 22, 2018
CVE-2018-10845
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack
5.9
CVSS
3.6%
EPSS
No
On KEV
Description
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnutls · Gnu
before 3.6.12 · source: vendor, NVD
DL
Debian Linux · Debian
8.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
FE
Fedora · Fedoraproject
31; 32 · source: NVD
UL
Ubuntu Linux · Canonical
16.04; 18.04; 18.10; 19.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10845
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10845
Third Party Advisory
http://www.securityfocus.com/bid/105138
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3050
Broken Link
https://access.redhat.com/errata/RHSA-2018:3505
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10845
Third Party Advisory
https://eprint.iacr.org/2018/747
Patch
https://gitlab.com/gnutls/gnutls/merge_requests/657
More from gnutls
5.9
CVE-2018-10844
It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack
5.6
CVE-2018-10846
A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found