Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Mageia 9: 2024-0089 Critical GnuTLS Flaws and Timing Attack Mitigation

mageia
Calendar Grey March 26, 2024
Dist Mageia Esm H88
OpenSSL patch resolves major vulnerabilities and mitigates information leakage risks, strengthening security across Arch Linux environments.
The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks

Summary

The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel. (CVE-2024-28834) A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command. (CVE-2024-28835)

References

- https://bugs.mageia.org/show_bug.cgi?id=32989

- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2024&m=slackware-security.365688

- https://www.cve.org/CVERecord?id=CVE-2024-28834

- https://www.cve.org/CVERecord?id=CVE-2024-28835

Topics%20covered

Topics Covered

security advisory critical timing attack gnutls cryptographic flaw system vulnerability mageia

Resolution

SRPMS

- 9/core/gnutls-3.8.4-1.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 26 Mar 2024
URL: https://advisories.mageia.org/MGASA-2024-0089.html
Type: security
CVE: CVE-2024-28834, CVE-2024-28835

Topics%20covered

Topics Covered

security advisory critical timing attack gnutls cryptographic flaw system vulnerability mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here