Vulnerability Description
It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Gnutls | < 3.6.12 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Workstation | 7.0 |
| Canonical | Ubuntu Linux | 16.04 |
| Fedoraproject | Fedora | 31 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/105138Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3050Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3505Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10845Issue TrackingPatchThird Party Advisory
- https://eprint.iacr.org/2018/747Third Party Advisory
- https://gitlab.com/gnutls/gnutls/merge_requests/657PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/10/msg00022.htmlThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://usn.ubuntu.com/3999-1/Third Party Advisory
- http://www.securityfocus.com/bid/105138Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3050Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3505Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10845Issue TrackingPatchThird Party Advisory
- https://eprint.iacr.org/2018/747Third Party Advisory
FAQ
What is CVE-2018-10845?
CVE-2018-10845 is a vulnerability with a CVSS score of 5.9 (MEDIUM). It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recov...
How severe is CVE-2018-10845?
CVE-2018-10845 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-10845?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Gnutls, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Canonical Ubuntu Linux.