The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 1 | gnutls | 2013-06-11 22:44 | ALAS-2013-197 |
Amazon Linux 1 | gnutls | 2013-03-14 22:04 | ALAS-2013-172 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv2 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
NVD | CVSSv2 | 4.0 | AV:N/AC:H/Au:N/C:P/I:P/A:N |