A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles     verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same     physical core as the victim process, could use this to extract plaintext or in some cases downgrade any     TLS connections to a vulnerable server. (CVE-2018-16868)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for gnutls fixes the following issues :

Security issue fixed :

CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification (bsc#1118087).

Non-security issue fixed: Explicitly require libnettle 3.4.1 to prevent missing symbol errors (bsc#1134856).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gnutls fixes the following issues :

Security issue fixed :

  - CVE-2018-16868: Fixed Bleichenbacher-like side channel     leakage in PKCS#1 v1.5 verification (bsc#1118087).

Non-security issue fixed :

  - Explicitly require libnettle 3.4.1 to prevent missing     symbol errors (bsc#1134856).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gnutls fixes to version 3.6.7 the following issues :

Security issued fixed :

  - CVE-2019-3836: Fixed an invalid pointer access via     malformed TLS1.3 async messages (bsc#1130682).

  - CVE-2019-3829: Fixed a double free vulnerability in the     certificate verification API (bsc#1130681).

  - CVE-2018-16868: Fixed Bleichenbacher-like side channel     leakage in PKCS#1 v1.5 verification and padding oracle     verification (bsc#1118087)

Non-security issue fixed :

  - Update gnutls to support TLS 1.3 (fate#327114) 

This update was imported from the SUSE:SLE-15:Update update project.

This update for gnutls fixes to version 3.6.7 the following issues :

Security issued fixed :

CVE-2019-3836: Fixed an invalid pointer access via malformed TLS1.3 async messages (bsc#1130682).

CVE-2019-3829: Fixed a double free vulnerability in the certificate verification API (bsc#1130681).

CVE-2018-16868: Fixed Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification and padding oracle verification (bsc#1118087)

Non-security issue fixed: Update gnutls to support TLS 1.3 (fate#327114)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Added explicit Requires for nettle >= 3.4.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-16868

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to upstream 3.6.5 release

  - Security fix for CVE-2018-16868

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New gnutls packages are available for Slackware 14.2 and -current to fix security issues.

ID	Name	Product	Family	Severity
222306	Linux Distros Unpatched Vulnerability : CVE-2018-16868	Nessus	Misc.	medium
126442	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2019:1351-2)	Nessus	SuSE Local Security Checks	medium
125619	openSUSE Security Update : gnutls (openSUSE-2019-1477)	Nessus	SuSE Local Security Checks	medium
125465	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2019:1351-1)	Nessus	SuSE Local Security Checks	medium
124714	openSUSE Security Update : gnutls (openSUSE-2019-1353)	Nessus	SuSE Local Security Checks	medium
124454	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2019:1121-1)	Nessus	SuSE Local Security Checks	medium
121169	Fedora 28 : gnutls (2019-1a0d4443f8)	Nessus	Fedora Local Security Checks	medium
121141	Fedora 29 : gnutls (2019-99eefddc65)	Nessus	Fedora Local Security Checks	medium
121076	Fedora 28 : gnutls (2019-24dc022a51)	Nessus	Fedora Local Security Checks	medium
120549	Fedora 29 : gnutls (2018-79f7540a1e)	Nessus	Fedora Local Security Checks	medium
119447	Slackware 14.2 / current : gnutls (SSA:2018-339-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2018-16868

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium