CVE-2023-5981

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.(CVE-2023-5981)

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)
• gnutls: incomplete fix for CVE-2023-5981 (CVE-2024-0553)
• gnutls: rejects certificate chain with distributed trust (CVE-2024-0567)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: incomplete fix for CVE-2023-5981 (CVE-2024-0553)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: timing side-channel in the RSA-PSK ClientKeyExchange
  • debian/patches/nettle-pk-randomness-level.patch: (nettle/pk) use the appropriate level of randomness for each operation.
  • debian/patches/pk-_gnutls_switch_lib_state.patch: (pk) always use _gnutls_switch_lib_state.
  • debian/patches/constant-time-cache-pkcs-1-rsa-decryption.patch: Constant time/cache PKCS#1 RSA decryption.
  • debian/patches/auth-rsa_psk-side-channel.patch: (auth/rsa_psk) side-step potential side-channel.
  • debian/libgnutls30.symbols: add gnutls_privkey_decrypt_data2.
  • CVE-2023-5981

• Add CVE-2024-0567 PoC test
• Remove src.rpm from sources
• CVE-2023-5981: removes branching that depends on secret data to prevent potential side-channel attack
• CVE-2024-0553: minimize branching after decryption

• Add CVE-2024-0567 PoC test
• Remove src.rpm from sources
• CVE-2023-5981: removes branching that depends on secret data to prevent potential side-channel attack
• CVE-2024-0553: minimize branching after decryption

• CVE-2023-5981, CVE-2024-0553: fix timing sidechannel in RSA-PSK key exchange

• Keep the broken pkcs11 tests disabled.
• Added CVE-2024-0567 PoC test.
• CVE-2023-5981-pre1: improve level of randomness for each operations, always use _gnutls_switch_lib_state for pk wrappers.
• CVE-2023-5981-pre2: add constant time/cache operations to prevent or minimaze timining or cache side channel attacks.
• CVE-2023-5981: removes branching that depends on secret data to prevent potential side-channel attack.
• CVE-2024-0553: minimize branching after decryption.

• Keep the broken pkcs11 tests disabled.
• Added CVE-2024-0567 PoC test.
• CVE-2023-5981-pre1: improve level of randomness for each operations, always use _gnutls_switch_lib_state for pk wrappers.
• CVE-2023-5981-pre2: add constant time/cache operations to prevent or minimaze timining or cache side channel attacks.
• CVE-2023-5981: removes branching that depends on secret data to prevent potential side-channel attack.
• CVE-2024-0553: minimize branching after decryption.

• Keep the broken pkcs11 tests disabled.
• Added CVE-2024-0567 PoC test.
• CVE-2023-5981-pre1: improve level of randomness for each operations, always use _gnutls_switch_lib_state for pk wrappers.
• CVE-2023-5981-pre2: add constant time/cache operations to prevent or minimaze timining or cache side channel attacks.
• CVE-2023-5981: removes branching that depends on secret data to prevent potential side-channel attack.
• CVE-2024-0553: minimize branching after decryption.

• SECURITY UPDATE: timing side-channel in RSA-PSK ClientKeyExchange
  • debian/patches/CVE-2023-5981-pre1.patch: use the appropriate level of randomness for each nettle operation and fail through the library state instead of abort(), in lib/nettle/pk.c, lib/fips.h, lib/includes/gnutls/crypto.h.
  • debian/patches/CVE-2023-5981-pre2.patch: add the side-channel silent gnutls_privkey_decrypt_data2() on top of nettle rsa_sec_decrypt(), in lib/gnutls_privkey.c, lib/nettle/pk.c, lib/pkcs11_privkey.c, configure.ac and related headers, with selftest and test.
  • debian/patches/CVE-2023-5981.patch: use the new function in the RSA-PSK server without branching on the decryption result, in lib/auth/rsa_psk.c.
  • debian/libgnutls30.symbols: add gnutls_privkey_decrypt_data2.
  • debian/control: build-depend on nettle-dev with rsa_sec_decrypt.
  • CVE-2023-5981
• SECURITY UPDATE: incomplete fix for CVE-2023-5981
  • debian/patches/CVE-2024-0553.patch: move the PSK lookup and key setup before the decryption, in lib/auth/rsa_psk.c.
  • debian/patches/CVE-2026-5260-decrypt_data2.patch: reject a ciphertext that does not match the modulus size and size the PKCS#11 buffer for the plaintext, in lib/auth/rsa_psk.c and lib/pkcs11_privkey.c.
  • CVE-2024-0553

The updated packages fix a security vulnerability: A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. (CVE-2023-5981)

These are all security issues fixed in the gnutls-3.8.2-1.1 package on the GA media of openSUSE Tumbleweed.

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

Security Fix(es):

• gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for gnutls fixes the following issues:

• CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange (bsc#1208143).
• CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

This update for gnutls fixes the following issues:

• CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

This update for gnutls fixes the following issues:

• CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

This update for gnutls fixes the following issues:

• CVE-2024-0553: Fixed insufficient mitigation for side channel attack in RSA-PSK, aka CVE-2023-5981 (bsc#1218865).

This update for gnutls fixes the following issues:

Security issues fixed:

• CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange (bsc#1208143).
• CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).
• CVE-2024-0567: Fixed an incorrect rejection of certificate chains with distributed trust (bsc#1218862).
• CVE-2024-0553: Fixed a timing attack against the RSA-PSK key exchange, which could lead to the leakage of sensitive data (bsc#1218865).

FIPS 140-3 certification related bugs fixed:

• FIPS: Set error state when jent init failed in FIPS mode (bsc#1202146)

• FIPS: Make XTS key check failure not fatal (bsc#1203779)

• FIPS: Added GnuTLS DH/ECDH pairwise consistency check for public key regeneration [bsc#1207183]

• FIPS: Change all the 140-2 references to FIPS 140-3 in order to account for the new FIPS certification [bsc#1207346]

• FIPS: Make the jitterentropy calls thread-safe (bsc#1208146).

• FIPS: GnuTLS DH/ECDH PCT public key regeneration (bsc#1207183).

• FIPS: Fix pct_test() return code in case of error (bsc#1207183)

• FIPS: Establish PBKDF2 additional requirements [bsc#1209001]

  • Set the minimum output key length to 112 bits (FIPS 140-3 IG D.N)
  • Set the minimum salt length to 128 bits (SP 800-132 sec. 5.1)
  • Set the minimum iterations count to 1000 (SP 800-132 sec 5.2)
  • Set the minimum passlen of 20 characters (SP SP800-132 sec 5)
  • Add regression tests for the new PBKDF2 requirements.

Other issues fixed:

• Fix AVX CPU feature detection for OSXSAVE (bsc#1203299) This fixes a SIGILL termination at the verzoupper instruction when trying to run GnuTLS on a Linux kernel with the noxsave command line parameter set. Relevant mostly for virtual systems.
• Increase the limit of TLS PSK usernames from 128 to 65535 characters. [bsc#1208237, jsc#PED-1562]

It was discovered that GnuTLS had a timing side-channel when handling certain RSA-PSK key exchanges. A remote attacker could possibly use this issue to recover sensitive information.

USN-6499-1 fixed vulnerabilities in GnuTLS. This update provides the corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that GnuTLS had a timing side-channel when handling certain RSA-PSK key exchanges. A remote attacker could possibly use this issue to recover sensitive information.