Medium severity · published Dec 3, 2018
CVE-2018-16868
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data
5.6
CVSS
0.6%
EPSS
No
On KEV
Description
A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Physical
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnutls · Gnu
through 3.6.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16868
Technical Description
http://cat.eyalro.net/
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00068.html
Third Party Advisory
http://www.securityfocus.com/bid/106080
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16868
More from Gnutls
9.8
CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in username
9.8
CVE-2021-20232
A flaw was found in gnutls
9.8
CVE-2021-20231
A flaw was found in gnutls
9.8
CVE-2017-5337
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted…
9.8
CVE-2017-5336
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified…