Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu: 5901-1 Critical: GnuTLS Information Exposure Timing Attack

ubuntu
Calendar Grey February 28, 2023
Scroller Ubuntu
The recent GnuTLS patch tackles significant data leakage issues; impacted Ubuntu iterations are detailed along with guidance for applying the updates.
GnuTLS could be made to expose sensitive information over the network.

Summary

GnuTLS could be made to expose sensitive information over the network.

Software Description:

- gnutls28: GNU TLS library

Details:

Hubert Kario discovered that GnuTLS had a timing side-channel when handling

certain RSA messages. A remote attacker could possibly use this issue to

recover sensitive information.

Topics%20covered

Topics Covered

security advisory critical software update timing attack information exposure ubuntu gnutls

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   libgnutls30                     3.7.7-2ubuntu2.1

Ubuntu 22.04 LTS:
   libgnutls30                     3.7.3-4ubuntu1.2

Ubuntu 20.04 LTS:
   libgnutls30                     3.6.13-2ubuntu1.8

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5901-1

CVE-2023-0361

Severity
critical
Lowest
Low
Medium
High
Critical

February 28, 2023

Topics%20covered

Topics Covered

security advisory critical software update timing attack information exposure ubuntu gnutls

Package Information

https://launchpad.net/ubuntu/+source/gnutls28/3.7.7-2ubuntu2.1
https://launchpad.net/ubuntu/+source/gnutls28/3.7.3-4ubuntu1.2
https://launchpad.net/ubuntu/+source/gnutls28/3.6.13-2ubuntu1.8

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.