Inadequate Encryption Strength in GnuTLS - CVE-2023-0361

Vulnerability identifier: #VU72125

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0361

CWE-ID: CWE-326

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error in the TLS RSA key exchange. A remote attacker can perform Bleichenbacher oracle attack and decrypt information.

GnuTLS
Debian Linux
Gentoo Linux
Oracle Solaris
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Slackware Linux
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
VMware Tanzu Application Service for VMs
Isolation Segment
VolSync
Data Lakehouse
Migration Toolkit for Runtimes
Ansible Automation Platform
Migration Toolkit for Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
Red Hat OpenStack
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Network Analytics Data Director
Netcool Operations Insight
IBM MQ Operator
Red Hat OpenShift distributed tracing (RHOSDT)
IBM Cloud Transformation Advisor
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
Node Health Check Operator
Self Node Remediation Operator
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Service Mesh
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Node Maintenance Operator
OpenShift Container Platform for Windows Containers
VMware Tanzu Operations Manager
Windows Container Support for Red Hat OpenShift
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Oracle Enterprise Operations Monitor
Dell EMC Container Storage Modules
OpenShift Developer Tools and Services
LANTIME Operating System Firmware (LTOS)
Red Hat Single Sign-On
MySQL Cluster
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libgnutls-devel
libgnutls30-hmac
libgnutls30-32bit
libgnutlsxx-devel
libgnutlsxx28-debuginfo
libgnutlsxx28
gnutls
libgnutls30-debuginfo
libgnutls30-hmac-32bit
libgnutls30
gnutls-debugsource
gnutls-debuginfo
libgnutls30-32bit-debuginfo
libgnutls30 (Ubuntu package)
gnutls-utils
gnutls-devel
gnutls-help
gnutls (Red Hat package)
gnutls-dane
gnutls-c++
gnutls28 (Debian package)
libgnutls-devel-32bit
gnutls-guile
gnutls-guile-debuginfo
gnutls-3.8.0-2.fc36 guile-gnutls
gnutls-3.8.0-1.fc37 guile-gnutls
gnutls-3.8.0-2.fc38 guile-gnutls
net-libs/gnutls
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
ObjectScale
Dell EMC Streaming Data Platform
IBM Cloud Pak for Watson AIOps
Dell PowerProtect Cyber Recovery
Cloud Pak for Security (CP4S)

Install updates from vendor's website.

GnuTLS - update to 3.8.0
Oracle Solaris - update to 11.4 SRU 71
Node Health Check Operator - update to 0.4.1
VolSync - addressed in versions 0.5.4, 0.6.3
Self Node Remediation Operator - update to 0.5.1
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.1.1
Red Hat OpenShift Serverless - update to 1.29.0
Data Lakehouse - update to 1.1.0.0
Migration Toolkit for Runtimes - addressed in versions 1.1.0, 1.1.1
Migration Toolkit for Containers - addressed in versions 1.7.9, 1.7.10
Multicluster Engine for Kubernetes - addressed in versions 2.0.8, 2.1.6, 2.1.7, 2.2.3, 2.2.4
OpenShift Service Mesh - addressed in versions 2.2.7, 2.2.8, 2.3.5, 2.4.1
Migration Toolkit for Virtualization - update to 2.4.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.8, 2.6.5, 2.6.6, 2.7.3, 2.7.4
Red Hat Advanced Cluster Security for Kubernetes - update to 3.73.5
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.11.43, 4.11.45, 4.12.22, 4.13.0, 4.13.4, 4.13.5
OpenShift Virtualization - update to 4.11.6
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.11.7, 4.12.3, 4.13.0
Node Maintenance Operator - update to 5.0.1
OpenShift Logging - update to 5.6.5
Red Hat Migration Toolkit for Applications - update to 6.1.0
OpenShift Container Platform for Windows Containers - update to 6.0.1
LANTIME Operating System Firmware (LTOS) - update to 7.08.002
Red Hat Single Sign-On - update to 7.6.3
MySQL Cluster - update to 8.0.34
ObjectScale - update to 1.4.0
Netcool Operations Insight - update to 1.6.10
Dell EMC Streaming Data Platform - update to 1.7.0
Dell EMC Container Storage Modules - update to 1.7.0
Cloud Pak for Security (CP4S) - update to 1.10.12.0
IBM MQ Operator - addressed in versions 2.0.10, 2.3.2
Red Hat OpenShift distributed tracing (RHOSDT) - update to 2.8.0
VMware Tanzu Operations Manager - update to 3.0.5
IBM Cloud Transformation Advisor - update to 3.5.2
libgnutls-devel - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.4.27.1
libgnutls30-hmac - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.1.3.1, 3.7.3-150400.4.27.1
libgnutls30-32bit - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.4.27.1
libgnutlsxx-devel - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.4.27.1
libgnutlsxx28-debuginfo - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.4.27.1
libgnutlsxx28 - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.4.27.1
gnutls - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.1.3.1, 3.7.3-150400.4.27.1
libgnutls30-debuginfo - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.1.3.1, 3.7.3-150400.4.27.1
libgnutls30-hmac-32bit - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.4.27.1
libgnutls30 - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.1.3.1, 3.7.3-150400.4.27.1
gnutls-debugsource - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.1.3.1, 3.7.3-150400.4.27.1
gnutls-debuginfo - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.1.3.1, 3.7.3-150400.4.27.1
libgnutls30-32bit-debuginfo - addressed in versions 3.6.7-150000.6.50.1, 3.6.7-150200.14.25.2, 3.7.3-150400.4.27.1
libgnutls30 (Ubuntu package) - addressed in versions 3.6.13-2ubuntu1.8, 3.7.3-4ubuntu1.2, 3.7.7-2ubuntu2.1
gnutls-utils - update to 3.6.14-11
gnutls-debuginfo - update to 3.6.14-11
gnutls-debugsource - update to 3.6.14-11
gnutls-devel - update to 3.6.14-11
gnutls-help - update to 3.6.14-11
gnutls - update to 3.6.14-11
gnutls (Red Hat package) - addressed in versions 3.6.16-5.el8_6.1, 3.6.16-6.el8_7, 3.7.6-18.el9_0, 3.7.6-18.el9_1
gnutls-devel - update to 3.6.16-6.0.1
gnutls-utils - update to 3.6.16-6.0.1
gnutls-dane - update to 3.6.16-6.0.1
gnutls-c++ - update to 3.6.16-6.0.1
gnutls - update to 3.6.16-6.0.1
gnutls28 (Debian package) - update to 3.7.1-5+deb11u3
libgnutls-devel-32bit - update to 3.7.3-150400.4.27.1
gnutls-guile - update to 3.7.3-150400.4.27.1
gnutls-guile-debuginfo - update to 3.7.3-150400.4.27.1
gnutls - update to 3.7.8-360
gnutls - update to 3.7.9
gnutls-3.8.0-2.fc36 guile-gnutls - update to 3.7.11-1.fc36
gnutls-3.8.0-1.fc37 guile-gnutls - update to 3.7.11-1.fc37
gnutls-3.8.0-2.fc38 guile-gnutls - update to 3.7.11-1.fc38
net-libs/gnutls - update to 3.8.5
IBM Cloud Pak for Watson AIOps - update to 4.2.0
Windows Container Support for Red Hat OpenShift - update to 7.1.0
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.21, 22.0.2.5
IBM Robotic Process Automation - addressed in versions 21.0.7.8, 23.0.9

• http://www.slackware.com/security/viewer.php?l=slackware-security&y=2023&m=slackware-security.345884

• Bleichenbacher oracle attack in GnuTLS
• Slackware Linux update for gnutls
• Debian update for gnutls28
• SUSE update for gnutls
• Ubuntu update for gnutls28
• SUSE update for gnutls
• Red Hat Enterprise Linux 9 update for gnutls
• Red Hat Enterprise Linux 9.0 Extended Update Support update for gnutls
• Red Hat Enterprise Linux 8 update for gnutls
• Inadequate Encryption Strength in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.11
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.6
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.0
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.5
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Distributed Tracing
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.7
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.6
• VMware Tanzu products update for GnuTLS
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Red Hat Enterprise Linux 8.6 Extended Update Support update for gnutls
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.73
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• OpenShift Container Platform 4.11 update for golang
• Migration Toolkit for Containers (MTC) 1.7 update for golang
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.2
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.11
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.12
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• OpenShift Container Platform 4.13 update for golang
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Inadequate encryption strength in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in MySQL Cluster
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat OpenShift support for Windows containers
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.2
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.3
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in Red Hat OpenShift support for Windows Containers 6.0
• Multiple vulnerabilities in Dell Container Storage Modules
• Multiple vulnerabilities in Red Hat VolSync 0.6
• Multiple vulnerabilities in Red Hat VolSync 0.5
• Fedora 36 update for gnutls-3.8.0-2.fc36 guile-gnutls
• Fedora 38 update for gnutls-3.8.0-2.fc38 guile-gnutls
• Fedora 37 update for gnutls-3.8.0-1.fc37 guile-gnutls
• Multiple vulnerabilities in Red Hat OpenStack
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Red Hat OpenShift Virtualization release 4.11
• Multiple vulnerabilities in Oracle Enterprise Operations Monitor
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• Multiple vulnerabilities in Red Hat Self Node Remediation Operator 0.5
• Multiple vulnerabilities in Red Hat Node Maintenance Operator 5.0
• Multiple vulnerabilities in Node Health Check Operator 0.4
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• SUSE update for gnutls
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Netcool Operations Insight
• openEuler update for gnutls
• SUSE update for gnutls
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Amazon Linux AMI update for gnutls
• Multiple vulnerabilities in Dell ObjectScale
• Oracle Solaris update for thrid-party components
• Anolis OS update for gnutls
• Multiple vulnerabilities in Meinberg LANTIME firmware (August 2023)
• Gentoo update for GnuTLS