Detections
Analytics
AlmaLinux 9 : gnutls (ALSA-2024:0533)
high Nessus Plugin ID 189757
Synopsis
The remote AlmaLinux host is missing one or more security updates.Description
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0533 advisory.- A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. (CVE-2023-5981)
- A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. (CVE-2024-0553)
- A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure.
This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.
(CVE-2024-0567)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 189757
File Name: alma_linux_ALSA-2024-0533.nasl
Version: 1.0
Type: local
Family: Alma Linux Local Security Checks
Published: 1/30/2024
Updated: 1/30/2024
Supported Sensors: Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2024-0553
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:alma:linux:9::highavailability, cpe:/o:alma:linux:9::resilientstorage, p-cpe:/a:alma:linux:gnutls-utils, p-cpe:/a:alma:linux:gnutls-c%2b%2b, cpe:/o:alma:linux:9::appstream, cpe:/o:alma:linux:9::realtime, cpe:/o:alma:linux:9, p-cpe:/a:alma:linux:gnutls-dane, cpe:/o:alma:linux:9::sap_hana, cpe:/o:alma:linux:9::supplementary, p-cpe:/a:alma:linux:gnutls-devel, cpe:/o:alma:linux:9::sap, p-cpe:/a:alma:linux:gnutls, cpe:/o:alma:linux:9::crb, cpe:/o:alma:linux:9::nfv, cpe:/o:alma:linux:9::baseos
Required KB Items: Host/local_checks_enabled, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/29/2024
Vulnerability Publication Date: 11/28/2023