CVE-2018-10845

CWE-385CWE-327 — Broken Cryptographic Algorithm13 documents8 sources
Severity
5.9MEDIUM
EPSS
0.6%
top 31.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
GNU Gnutls[unknown] GnutlsCanonical Ubuntu Linux+5 more
Timeline
PublishedAug 22
Latest updateMay 13

Description

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages7 packages

▶NVDgnu/gnutls< 3.6.12
▶Debiangnutls28< 3.5.19-1+3
▶Ubuntugnutls28< 3.4.10-4ubuntu1.5+1
▶CVEListV5[unknown]/gnutlsn/a

Also affects: Debian Linux 8.0, Fedora 31, 32, Ubuntu Linux 16.04, 18.04, 18.10, 19.04

Patches

Patch: bugzilla.redhat.com ↗Patch: gitlab.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-m5px-2q2g-hxc2: It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack↗2022-05-13
▶
OSV
gnutls28 vulnerabilities↗2019-05-30
▶
CVEList
CVE-2018-10845: It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack↗2018-08-22
▶
OSV
CVE-2018-10845: It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack↗2018-08-22
▶

📋Vendor Advisories

3
Ubuntu
GnuTLS vulnerabilities↗2019-05-30
▶
Red Hat
gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant↗2018-08-21
▶
Debian
CVE-2018-10845: gnutls28 - It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a ...↗2018
▶

💬Community

5
Bugzilla
CVE-2018-10845 mingw-gnutls: gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant [fedora-all]↗2018-08-21
▶
Bugzilla
CVE-2018-10845 mingw-gnutls: gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant [epel-all]↗2018-08-21
▶
Bugzilla
CVE-2018-10845 gnutls30: gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant [epel-all]↗2018-08-21
▶
Bugzilla
CVE-2018-10845 gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant [fedora-all]↗2018-08-21
▶
Bugzilla
CVE-2018-10845 gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant↗2018-05-25
▶
CVE-2018-10845 (MEDIUM CVSS 5.9) | It was found that the GnuTLS implem | cvebase.io