CVE-2018-16868

CVSS 4.7 MEDIUMEPSS 0.6%CWE-203

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.7EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

03 Dec 2018Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Affected products

[UNKNOWN] · gnutls

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://cat.eyalro.net/http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00068.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16868 http://www.securityfocus.com/bid/106080