{"id":"CVE-2018-16869","aliases":["CLSA-2024-1709839956","CLSA-2024-1734027856","CLSA-2025-1757947030","CLSA-2026-1791541027","DEBIAN-CVE-2018-16869","EUVD-2018-8660","GHSA-575w-jrpq-q9xv","MGASA-2019-0024","SUSE-SU-2018:4193-1","UBUNTU-CVE-2018-16869","USN-4990-1","openSUSE-SU-2024:10962-1"],"status":"published","title":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle...","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","severity":{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01495,"percentile":0.7436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2018-12-03T14:00:00Z","modified":"2026-10-26T09:32:02Z","fixes":[{"ecosystem":"TuxCare:CentOS:7","package":"nettle","fixed_in":["2.7.1-9.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nettle-devel","fixed_in":["2.7.1-9.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nettle","fixed_in":["2.7.1-9.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nettle-devel","fixed_in":["2.7.1-9.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nettle","fixed_in":["2.7.1-9.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nettle-devel","fixed_in":["2.7.1-9.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nettle","fixed_in":["3.4.1~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nettle","fixed_in":["3.4.1~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nettle","fixed_in":["3.4.1~rc1-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"nettle","fixed_in":["3.4.1-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libnettle","fixed_in":["3.4-4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libnettle","fixed_in":["3.4-4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"nettle","fixed_in":["3.4.1-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nettle-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nettle-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nettle-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-9.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libhogweed4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-1ubuntu0.16.04.2+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libnettle6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-1ubuntu0.16.04.2+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nettle-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-1ubuntu0.16.04.2+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nettle-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-1ubuntu0.16.04.2+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1~rc1-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libnettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libnettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-4.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","2.7.1-1ubuntu0.1","2.7.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1-4","3.2-1","3.2-1ubuntu0.16.04.1","3.2-1ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-0ubuntu0.18.04.1"}]}],"versions":["3.3-2","3.4-1","3.4-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-0ubuntu0.18.04.1"}]}],"versions":["3.3-2","3.4-1","3.4-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nettle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+really3.5.1-2ubuntu0.2"}]}],"versions":["3.4.1-1","3.5.1+really3.5.1-2","3.5.1+really3.5.1-2ubuntu0.1"],"bundled":2}],"products":[{"vendor":"[unknown]","product":"nettle"},{"vendor":"nettle_project","product":"nettle"}],"references":[{"url":"http://www.securityfocus.com/bid/106092","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://cat.eyalro.net/","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16869","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16869","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-575w-jrpq-q9xv"},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1709839956.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/oraclelinux7-els/CLSA-2024-1734027856.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2025-1757947030.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1791541027.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16869","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0024.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24080","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-12/msg00120.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20184193-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118086","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16869","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-16869","tags":["report"]},{"url":"https://lists.lysator.liu.se/pipermail/nettle-bugs/2018/007363.html","tags":["report"]},{"url":"https://lists.debian.org/debian-lts/2019/03/msg00021.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4990-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16869","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3580","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3580","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16869","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","status":"published","published":"2018-12-03T14:00:00Z","modified":"2024-08-05T10:32:54.115Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-8660","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","status":"published","published":"2018-12-03T14:00:00Z","modified":"2024-08-05T10:32:54Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:40.316949Z"}],"ghsa":[{"id":"GHSA-575w-jrpq-q9xv","title":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle...","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","status":"published","published":"2022-05-13T01:12:24Z","modified":"2023-02-01T05:03:51Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:50:06.799159Z"}],"nvd":[{"id":"CVE-2018-16869","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","status":"published","published":"2018-12-03T14:29:00.38Z","modified":"2026-06-17T01:44:57.233Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.3,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:04:49.995593Z"}],"osv":[{"id":"CVE-2018-16869","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","status":"published","published":"2018-12-03T14:29:00.38Z","modified":"2026-04-16T06:20:44.749869196Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16869","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","status":"published","published":"2018-12-03T14:29:00.38Z","modified":"2026-10-23T18:03:20.025788941Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-16869","description":"A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.","status":"published","published":"2018-12-03T14:29:00Z","modified":"2026-04-22T11:48:05.226974Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"medium"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"CLSA-2024-1709839956","title":"nettle: Fix of CVE-2018-16869","description":"- Port side-channel silent functions from 3.4.1. Partially fix\n  for CVE-2018-16869\n- CVE-2018-16869: Add side-channel silent memory, math, PKCS1,\n  RSA functions\n- Added tests for side-channel silent implementations","status":"published","published":"2024-03-07T19:32:39Z","modified":"2026-06-01T00:33:04.041427959Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1734027856","title":"nettle: Fix of CVE-2018-16869","description":"- Port side-channel silent functions from 3.4.1. Partially fix\n  for CVE-2018-16869\n- CVE-2018-16869: Add side-channel silent memory, math, PKCS1,\n  RSA functions\n- Added tests for side-channel silent implementations","status":"published","published":"2024-12-12T18:24:22Z","modified":"2026-06-01T00:32:56.670418685Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1757947030","title":"nettle: Fix of CVE-2018-16869","description":"- Port side-channel silent functions from 3.4.1. Partially fix\n  for CVE-2018-16869\n- CVE-2018-16869: Add side-channel silent memory, math, PKCS1,\n  RSA functions\n- Added tests for side-channel silent implementations","status":"published","published":"2025-09-15T14:37:14Z","modified":"2026-06-01T00:33:27.849588108Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1791541027","title":"Fix CVE(s): CVE-2018-16869","description":"   * SECURITY UPDATE: Bleichenbacher-type side-channel in RSA decryption\n     - debian/patches/CVE-2018-16869-1.patch: add side-channel silent\n       memeql_sec and cnd_memcpy in memeql-sec.c, cnd-memcpy.c, memops.h,\n       ccm.c, examples/rsa-decrypt.c, Makefile.in, testsuite.\n     - debian/patches/CVE-2018-16869-2.patch: add side-channel silent RSA\n       root function _rsa_sec_compute_root and mpn_get_base256 in\n       rsa-sec-compute-root.c, rsa-internal.h, gmp-glue.c, gmp-glue.h,\n       Makefile.in.\n     - debian/patches/CVE-2018-16869-3.patch: add side-channel silent\n       PKCS#1 decoding _pkcs1_sec_decrypt in pkcs1-sec-decrypt.c,\n       rsa-internal.h, Makefile.in, testsuite.\n     - debian/patches/CVE-2018-16869-4.patch: add rsa_sec_decrypt and use\n       the side-channel silent root in rsa_compute_root_tr and\n       rsa_compute_root, and reject bad private keys early, in\n       rsa-sec-decrypt.c, rsa-sign-tr.c, rsa-sign.c,\n       rsa-sec-compute-root.c, rsa.h, Makefile.in, testsuite.\n     - debian/patches/CVE-2018-16869-5.patch: require input in range and of\n       fixed size in rsa_sec_decrypt, rsa_decrypt_tr, rsa_decrypt and\n       rsa_sec_compute_root_tr, and check the message length in\n       _pkcs1_sec_decrypt, in pkcs1-sec-decrypt.c, rsa-decrypt-tr.c,\n       rsa-decrypt.c, rsa-sec-decrypt.c, rsa-sign-tr.c, rsa.h, testsuite.\n     - debian/patches/CVE-2018-16869-6.patch: strip the PKCS#1 padding in\n       rsa_decrypt and rsa_decrypt_tr with the side-channel silent\n       _pkcs1_sec_decrypt_variable, in pkcs1-sec-decrypt.c,\n       pkcs1-decrypt.c, rsa-decrypt-tr.c, rsa-internal.h, testsuite.\n     - debian/libhogweed4.symbols, debian/libnettle6.symbols: added new\n       symbols.\n     - CVE-2018-16869\n     - CVE-2021-3580 (the input range checks in CVE-2018-16869-5.patch)","status":"published","published":"2026-10-09T10:17:18Z","modified":"2026-10-26T09:32:02.514686342Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"MGASA-2019-0024","title":"Updated nettle packages fix security vulnerability","description":"A leaky data conversion exposing a manager oracle (CVE-2018-16869).\n","status":"published","published":"2019-01-08T21:50:23Z","modified":"2026-04-16T06:26:22.850612158Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10962-1","title":"libhogweed6-3.7.3-1.2 on GA media","description":"These are all security issues fixed in the libhogweed6-3.7.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:18.56345Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:4193-1","title":"Security update for libnettle","description":"This update for libnettle fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-16869: Fixed a leaky data conversion exposing a manager oracle (bsc#1118086)\n","status":"published","published":"2018-12-19T12:53:27Z","modified":"2026-02-04T02:16:30.58056Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-4990-1","title":"nettle vulnerabilities","description":"It was discovered that Nettle incorrectly handled RSA decryption. A remote\nattacker could possibly use this issue to cause Nettle to crash, resulting\nin a denial of service. (CVE-2021-3580)\n\nIt was discovered that Nettle incorrectly handled certain padding oracles.\nA remote attacker could possibly use this issue to perform a variant of the\nBleichenbacher attack. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2018-16869)\n","status":"published","published":"2021-06-17T11:01:57Z","modified":"2026-04-22T10:15:40.013204Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}