Ubuntu 23.10: USN-6499-1 Critical: GnuTLS Timing Attack Risk

ubuntu

November 21, 2023

GnuTLS could be made to expose sensitive information over the network.

Summary

GnuTLS could be made to expose sensitive information over the network.

Software Description:

- gnutls28: GNU TLS library

Details:

It was discovered that GnuTLS had a timing side-channel when handling

certain RSA-PSK key exchanges. A remote attacker could possibly use this

issue to recover sensitive information.

Topics Covered

security advisory timing attack information exposure ubuntu gnutls

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   libgnutls30                     3.8.1-4ubuntu1.1

Ubuntu 23.04:
   libgnutls30                     3.7.8-5ubuntu1.1

Ubuntu 22.04 LTS:
   libgnutls30                     3.7.3-4ubuntu1.3

Ubuntu 20.04 LTS:
   libgnutls30                     3.6.13-2ubuntu1.9

In general, a standard system update will make all the necessary changes.