CVE-2013-1619
Fixed in a distro release EPSS 6%
The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Products: gnutls
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnutls28 | 3.0.22-3 |
| Debian 13 | gnutls28 | 3.0.22-3 |
| Debian 14 | gnutls28 | 3.0.22-3 |
| Red Hat Enterprise Linux 5 | gnutls | 0:1.4.1-10.el5_9.1 |
| Red Hat Enterprise Linux 5 | gnutls-debuginfo | 0:1.4.1-10.el5_9.1 |
| Red Hat Enterprise Linux 5 | gnutls-devel | 0:1.4.1-10.el5_9.1 |
| Red Hat Enterprise Linux 5 | gnutls-utils | 0:1.4.1-10.el5_9.1 |
| Red Hat Enterprise Linux 6 | gnutls | 0:2.8.5-10.el6_4.1 |
| Red Hat Enterprise Linux 6 | gnutls-debuginfo | 0:2.8.5-10.el6_4.1 |
| Red Hat Enterprise Linux 6 | gnutls-devel | 0:2.8.5-10.el6_4.1 |
| Red Hat Enterprise Linux 6 | gnutls-guile | 0:2.8.5-10.el6_4.1 |
| Red Hat Enterprise Linux 6 | gnutls-utils | 0:2.8.5-10.el6_4.1 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.4-20130306.2.el6_4 |