CVE-2012-0390
published 2012-01-06CVE-2012-0390: The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
1.23%
65.5th percentile
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.
Affected
57 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gnutls28 | < gnutls28 3.0.11-1 (bookworm) | gnutls28 3.0.11-1 (bookworm) |
| gnu | gnutls | <= 3.0.10 | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gnutls: DTLS plaintext recovery attack
vendor_redhat·2012-01-05·CVSS 4.3
CVE-2012-0390 [MEDIUM] gnutls: DTLS plaintext recovery attack
gnutls: DTLS plaintext recovery attack
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.
Statement: Not vulnerable. This issue did not affect the versions of gnutls as shipped with Red Hat Enterprise Linux 4, 5 and 6 as they did not include support for DTLS.
Package: gnutls (Red Hat Enterprise Linux 4) - Not affected
Package: gnutls (Red Hat Enterprise Linux 5) - Not affected
Package: gnutls (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2012-0390: gnutls28 - The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-hand...
vendor_debian·2012·CVSS 4.3
CVE-2012-0390 [MEDIUM] CVE-2012-0390: gnutls28 - The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-hand...
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.
Scope: local
bookworm: resolved (fixed in 3.0.11-1)
bullseye: resolved (fixed in 3.0.11-1)
forky: resolved (fixed in 3.0.11-1)
sid: resolved (fixed in 3.0.11-1)
trixie: resolved (fixed in 3.0.11-1)
GHSA
GHSA-8w6j-wjpg-446m: The DTLS implementation in GnuTLS 3
ghsa_unreviewed·2022-05-04·CVSS 4.3
CVE-2012-0390 [MEDIUM] GHSA-8w6j-wjpg-446m: The DTLS implementation in GnuTLS 3
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.
OSV
CVE-2012-0390: The DTLS implementation in GnuTLS 3
osv·2012-01-06·CVSS 4.3
CVE-2012-0390 [MEDIUM] CVE-2012-0390: The DTLS implementation in GnuTLS 3
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.
No detection rules found.
No public exploits indexed.
2012-01-06
Published