Every CVE Search/ Get API key

CVE-2018-16869

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle...

4.7 MediumFix available

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.49%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 4.7

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Record
CVE-2018-16869
CVSS 3.0
4.7 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-203
Updated
2026-11-02
EUVDEUVD-2018-8660 4.7

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Record
EUVD-2018-8660
CVSS 3.0
4.7 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-575w-jrpq-q9xv 5.7

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle...

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Record
GHSA-575w-jrpq-q9xv
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Weakness
CWE-203
Updated
2026-11-02
NVD 5.7

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Record
CVE-2018-16869
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS 3.0
4.7 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0
3.3 LowAV:L/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-203
Updated
2026-11-02
OSV 5.7

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Record
CVE-2018-16869
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-16869 5.7

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Record
DEBIAN-CVE-2018-16869
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2018-16869 5.7

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Record
UBUNTU-CVE-2018-16869
CVSS 3.1
5.7 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS 3.0
4.7 MediumCVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS 3.0
5.7 MediumCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVCLSA-2024-1709839956 No score

nettle: Fix of CVE-2018-16869

  • Port side-channel silent functions from 3.4.1. Partially fix for CVE-2018-16869
  • CVE-2018-16869: Add side-channel silent memory, math, PKCS1, RSA functions
  • Added tests for side-channel silent implementations
Record
CLSA-2024-1709839956
Updated
2026-11-02
OSVCLSA-2024-1734027856 No score

nettle: Fix of CVE-2018-16869

  • Port side-channel silent functions from 3.4.1. Partially fix for CVE-2018-16869
  • CVE-2018-16869: Add side-channel silent memory, math, PKCS1, RSA functions
  • Added tests for side-channel silent implementations
Record
CLSA-2024-1734027856
Updated
2026-11-02
OSVCLSA-2025-1757947030 No score

nettle: Fix of CVE-2018-16869

  • Port side-channel silent functions from 3.4.1. Partially fix for CVE-2018-16869
  • CVE-2018-16869: Add side-channel silent memory, math, PKCS1, RSA functions
  • Added tests for side-channel silent implementations
Record
CLSA-2025-1757947030
Updated
2026-11-02
OSVCLSA-2026-1791541027 No score

Fix CVE(s): CVE-2018-16869

  • SECURITY UPDATE: Bleichenbacher-type side-channel in RSA decryption
    • debian/patches/CVE-2018-16869-1.patch: add side-channel silent memeql_sec and cnd_memcpy in memeql-sec.c, cnd-memcpy.c, memops.h, ccm.c, examples/rsa-decrypt.c, Makefile.in, testsuite.
    • debian/patches/CVE-2018-16869-2.patch: add side-channel silent RSA root function _rsa_sec_compute_root and mpn_get_base256 in rsa-sec-compute-root.c, rsa-internal.h, gmp-glue.c, gmp-glue.h, Makefile.in.
    • debian/patches/CVE-2018-16869-3.patch: add side-channel silent PKCS#1 decoding _pkcs1_sec_decrypt in pkcs1-sec-decrypt.c, rsa-internal.h, Makefile.in, testsuite.
    • debian/patches/CVE-2018-16869-4.patch: add rsa_sec_decrypt and use the side-channel silent root in rsa_compute_root_tr and rsa_compute_root, and reject bad private keys early, in rsa-sec-decrypt.c, rsa-sign-tr.c, rsa-sign.c, rsa-sec-compute-root.c, rsa.h, Makefile.in, testsuite.
    • debian/patches/CVE-2018-16869-5.patch: require input in range and of fixed size in rsa_sec_decrypt, rsa_decrypt_tr, rsa_decrypt and rsa_sec_compute_root_tr, and check the message length in _pkcs1_sec_decrypt, in pkcs1-sec-decrypt.c, rsa-decrypt-tr.c, rsa-decrypt.c, rsa-sec-decrypt.c, rsa-sign-tr.c, rsa.h, testsuite.
    • debian/patches/CVE-2018-16869-6.patch: strip the PKCS#1 padding in rsa_decrypt and rsa_decrypt_tr with the side-channel silent _pkcs1_sec_decrypt_variable, in pkcs1-sec-decrypt.c, pkcs1-decrypt.c, rsa-decrypt-tr.c, rsa-internal.h, testsuite.
    • debian/libhogweed4.symbols, debian/libnettle6.symbols: added new symbols.
    • CVE-2018-16869
    • CVE-2021-3580 (the input range checks in CVE-2018-16869-5.patch)
Record
CLSA-2026-1791541027
Updated
2026-11-02
OSVMGASA-2019-0024 No score

Updated nettle packages fix security vulnerability

A leaky data conversion exposing a manager oracle (CVE-2018-16869).

Record
MGASA-2019-0024
Updated
2026-11-02
OSVopenSUSE-SU-2024:10962-1 No score

libhogweed6-3.7.3-1.2 on GA media

These are all security issues fixed in the libhogweed6-3.7.3-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10962-1
Updated
2026-11-02
OSVSUSE-SU-2018:4193-1 No score

Security update for libnettle

This update for libnettle fixes the following issues:

Security issues fixed:

  • CVE-2018-16869: Fixed a leaky data conversion exposing a manager oracle (bsc#1118086)
Record
SUSE-SU-2018:4193-1
Updated
2026-11-02
OSVUSN-4990-1 No score

nettle vulnerabilities

It was discovered that Nettle incorrectly handled RSA decryption. A remote attacker could possibly use this issue to cause Nettle to crash, resulting in a denial of service. (CVE-2021-3580)

It was discovered that Nettle incorrectly handled certain padding oracles. A remote attacker could possibly use this issue to perform a variant of the Bleichenbacher attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16869)

Record
USN-4990-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nettle
TuxCare:CentOS:7
 before 2.7.1-9.el7_9.tuxcare.els1
2.7.1-9.el7_9.tuxcare.els1
nettle-devel
TuxCare:CentOS:7
 before 2.7.1-9.el7_9.tuxcare.els1
2.7.1-9.el7_9.tuxcare.els1
nettle
TuxCare:OracleLinux:7
 before 2.7.1-9.el7_9.tuxcare.els1
2.7.1-9.el7_9.tuxcare.els1
nettle-devel
TuxCare:OracleLinux:7
 before 2.7.1-9.el7_9.tuxcare.els1
2.7.1-9.el7_9.tuxcare.els1
nettle
TuxCare:RHEL:7
 before 2.7.1-9.el7_9.tuxcare.els1
2.7.1-9.el7_9.tuxcare.els1
nettle-devel
TuxCare:RHEL:7
 before 2.7.1-9.el7_9.tuxcare.els1
2.7.1-9.el7_9.tuxcare.els1
libhogweed4
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.2-1ubuntu0.16.04.2+tuxcare.els1
3.2-1ubuntu0.16.04.2+tuxcare.els1
libnettle6
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.2-1ubuntu0.16.04.2+tuxcare.els1
3.2-1ubuntu0.16.04.2+tuxcare.els1
nettle-bin
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.2-1ubuntu0.16.04.2+tuxcare.els1
3.2-1ubuntu0.16.04.2+tuxcare.els1
nettle-dev
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.2-1ubuntu0.16.04.2+tuxcare.els1
3.2-1ubuntu0.16.04.2+tuxcare.els1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
nettle
Debian:12
 before 3.4.1~rc1-1
3.4.1~rc1-1
nettle
Debian:13
 before 3.4.1~rc1-1
3.4.1~rc1-1
nettle
Debian:14
 before 3.4.1~rc1-1
3.4.1~rc1-1
nettle
Mageia:6
 before 3.4.1-1.mga6
3.4.1-1.mga6
libnettle
SUSE:Linux Enterprise Module for Basesystem 15
 before 3.4-4.3.1
3.4-4.3.1
libnettle
SUSE:Linux Enterprise Module for Desktop Applications 15
 before 3.4-4.3.1
3.4-4.3.1
nettle
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.7.1-12.7.1-1ubuntu0.12.7.1-1ubuntu0.2
 None known
nettle
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.1.1-43.2-13.2-1ubuntu0.16.04.13.2-1ubuntu0.16.04.2
 None known
nettle
Ubuntu:18.04:LTS
 before 3.4.1-0ubuntu0.18.04.1, plus listed versions
3.3-23.4-13.4-1ubuntu0.1
3.4.1-0ubuntu0.18.04.1
nettle
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 3.4.1-0ubuntu0.18.04.1, plus listed versions
3.3-23.4-13.4-1ubuntu0.1
3.4.1-0ubuntu0.18.04.1
nettle
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 3.5.1+really3.5.1-2ubuntu0.2, plus listed versions
3.4.1-13.5.1+really3.5.1-23.5.1+really3.5.1-2ubuntu0.1
3.5.1+really3.5.1-2ubuntu0.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-16869 is a medium vulnerability (CVSS 4.7) in [unknown] Nettle, published December 3, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in nettle 2.7.1-9.el7_9.tuxcare.els1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open