Cryptographic issues in GnuTLS - CVE-2024-28834

Vulnerability identifier: #VU87671

CSH Severity: Medium

CVSS v4 BT: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-28834

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to a side-channel attack when using the gnutls_privkey_sign_data2 API function with the "GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE" flag. A remote attacker can launch Minerva attack and gain access to sensitive information.

GnuTLS
Gentoo Linux
Amazon Linux AMI
Oracle Solaris
Oracle Linux
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Slackware Linux
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
SmartFabric Storage Software
LANTIME Operating System Firmware (LTOS)
Migration Toolkit for Containers
Traffix SDC
Red Hat OpenShift Container Platform
Cryostat
Oracle Communications Network Analytics Data Director
Management Cloud Engine
Submariner
Multicluster GlobalHub
Migration Toolkit for Runtimes
Service Interconnect
IBM MQ Operator
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Red Hat OpenShift distributed tracing (RHOSDT)
IBM Cloud Transformation Advisor
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
IBM MQ
IBM Security Verify Governance
Red Hat OpenStack
OpenShift Service Mesh
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Virtualization
OpenShift Container Platform for Windows Containers
Cloud Pak for Network Automation
IBM Business Automation Manager Open Editions
webMethods Managed File Transfer
Oracle Communications User Data Repository
Oracle Communications Policy Management
OpenManage Network Integration (OMNI)
Enterprise SONiC
Storage Resource Manager
Watson Studio on Cloud Pak for Data - Execution Engine for Apache Hadoop
IBM supplied MQ Advanced container images
Juniper Secure Analytics (JSA)
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libgnutls30 (Ubuntu package)
gnutls-help
gnutls-devel
gnutls
gnutls-debugsource
gnutls-utils
gnutls-debuginfo
gnutls (Red Hat package)
gnutls-c++
gnutls-dane
libgnutls30-32bit
libgnutlsxx28
libgnutlsxx-devel
libgnutls-devel-32bit
libgnutls30-32bit-debuginfo
libgnutls30-hmac-32bit
libgnutls-devel-64bit
libgnutls30-64bit-debuginfo
libgnutls30-64bit
libgnutls30-hmac-64bit
gnutls-guile-debuginfo
libgnutlsxx28-debuginfo
libgnutls-devel
gnutls-guile
libgnutls30-hmac
libgnutls30
libgnutls30-debuginfo
gnutls-doc
libgnutls30t64 (Ubuntu package)
net-libs/gnutls
Juniper Junos Space
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
Dell EMC Storage Monitoring and Reporting (SMR)
Red Hat Ceph Storage
IBM Qradar SIEM
AMQ Broker
Dell EMC VxRail Appliance
IBM CICS TX Advanced

Install updates from vendor's website.

GnuTLS - update to 3.8.4
Oracle Solaris - update to 11.4 SRU 71
SmartFabric Storage Software - update to 1.4.3
Migration Toolkit for Containers - addressed in versions 1.7.15, 1.8.4
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.1, 2.5.2
Cloud Pak for Network Automation - update to 2.7.4
LANTIME Operating System Firmware (LTOS) - update to 7.08.010
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
Red Hat Single Sign-On - update to 7.6.8
IBM Business Automation Manager Open Editions - update to 9.1.1
Juniper Junos Space - update to 24.1R2
Submariner - update to 0.18.5
Multicluster GlobalHub - update to 1.2.1
Migration Toolkit for Runtimes - update to 1.2.6
OpenShift API for Data Protection (OADP) - update to 1.3.2
Service Interconnect - update to 1.5.4
Network Observability plugin for the Openshift Console - update to 1.6.0
Red Hat OpenShift GitOps - addressed in versions 1.10.5, 1.10.6, 1.11.4, 1.11.5, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.13.1
Red Hat OpenShift Serverless - update to 1.33.0
IBM MQ Operator - addressed in versions 2.0.22, 3.1.3
Ansible Automation Platform - update to 2.4
Multicluster Engine for Kubernetes - addressed in versions 2.5.8, 2.6.4, 2.6.7, 2.7.2, 2.7.4
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.8.7, 2.10.4, 2.10.5, 2.10.8, 2.11.4, 2.11.7, 2.12.0, 2.12.1, 2.12.3
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-394
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.0
libgnutls30 (Ubuntu package) - addressed in versions 3.6.13-2ubuntu1.11, 3.7.3-4ubuntu1.5, 3.8.1-4ubuntu1.3
gnutls-help - update to 3.6.14-16
gnutls-devel - update to 3.6.14-16
gnutls - update to 3.6.14-16
gnutls-debugsource - update to 3.6.14-16
gnutls-utils - update to 3.6.14-16
gnutls-debuginfo - update to 3.6.14-16
gnutls (Red Hat package) - addressed in versions 3.6.16-5.el8_6.4, 3.6.16-7.el8_8.3, 3.6.16-8.el8_9.3, 3.7.6-21.el9_2.3, 3.7.6-23.el9_3.4, 3.8.3-4.el9_4
gnutls-devel - addressed in versions 3.6.16-8.0.1, 3.8.2-4
gnutls - addressed in versions 3.6.16-8.0.1, 3.8.2-4
gnutls-c++ - addressed in versions 3.6.16-8.0.1, 3.8.2-4
gnutls-dane - addressed in versions 3.6.16-8.0.1, 3.8.2-4
gnutls-utils - addressed in versions 3.6.16-8.0.1, 3.8.2-4
OpenManage Network Integration (OMNI) - update to 3.7
libgnutls30-32bit - update to 3.7.3-150400.4.44.1
libgnutlsxx28 - update to 3.7.3-150400.4.44.1
libgnutlsxx-devel - update to 3.7.3-150400.4.44.1
libgnutls-devel-32bit - update to 3.7.3-150400.4.44.1
libgnutls30-32bit-debuginfo - update to 3.7.3-150400.4.44.1
libgnutls30-hmac-32bit - update to 3.7.3-150400.4.44.1
libgnutls-devel-64bit - update to 3.7.3-150400.4.44.1
libgnutls30-64bit-debuginfo - update to 3.7.3-150400.4.44.1
libgnutls30-64bit - update to 3.7.3-150400.4.44.1
libgnutls30-hmac-64bit - update to 3.7.3-150400.4.44.1
gnutls-guile-debuginfo - update to 3.7.3-150400.4.44.1
libgnutlsxx28-debuginfo - update to 3.7.3-150400.4.44.1
libgnutls-devel - update to 3.7.3-150400.4.44.1
gnutls-guile - update to 3.7.3-150400.4.44.1
libgnutls30-hmac - addressed in versions 3.7.3-150400.4.44.1, 3.7.3-150400.8.1
gnutls-debugsource - addressed in versions 3.7.3-150400.4.44.1, 3.7.3-150400.8.1
libgnutls30 - addressed in versions 3.7.3-150400.4.44.1, 3.7.3-150400.8.1
gnutls - addressed in versions 3.7.3-150400.4.44.1, 3.7.3-150400.8.1
libgnutls30-debuginfo - addressed in versions 3.7.3-150400.4.44.1, 3.7.3-150400.8.1
gnutls-debuginfo - addressed in versions 3.7.3-150400.4.44.1, 3.7.3-150400.8.1
gnutls - update to 3.8.0-380
gnutls-doc - update to 3.8.2-4
libgnutls30t64 (Ubuntu package) - update to 3.8.3-1.1ubuntu3.1
gnutls - update to 3.8.4
gnutls - addressed in versions 3.8.4-1.fc38, 3.8.4-1.fc39, 3.8.4-1.fc40
net-libs/gnutls - update to 3.8.5
IBM Cloud Transformation Advisor - update to 3.10.0
Red Hat OpenShift Dev Spaces - addressed in versions 3.15.0, 3.16.0, 3.17.0
Enterprise SONiC - update to 4.4.1
Red Hat Advanced Cluster Security for Kubernetes - update to 4.4.2
Red Hat OpenShift Container Platform - addressed in versions 4.12.57, 4.12.58, 4.13.42, 4.13.45, 4.14.27, 4.14.32, 4.14.33, 4.15.12, 4.15.15, 4.16.15, 4.17.0
OpenShift Virtualization - update to 4.14.6
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
Storage Resource Manager - update to 5.0.1.0
Watson Studio on Cloud Pak for Data - Execution Engine for Apache Hadoop - update to 5.0.3
App Connect Enterprise Certified Container - addressed in versions 5.0.18, 11.6.0
Red Hat Ceph Storage - update to 5.3
Red Hat Migration Toolkit for Applications - addressed in versions 6.2.3, 7.0.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
AMQ Broker - update to 7.12.0
Dell EMC VxRail Appliance - update to 8.0.213
OpenShift Container Platform for Windows Containers - addressed in versions 8.1.3, 10.15.3
IBM supplied MQ Advanced container images - addressed in versions 9.3.0.17-r2, 9.3.5.1-r2
IBM MQ - addressed in versions 9.3.0.20 FixPack, 9.3.5.2
IBM Security Verify Governance - update to 10.0.2.0.4
IBM CICS TX Advanced - update to 10.1.0.0 ifix29
Red Hat OpenStack - addressed in versions 16.2, 17.1

• https://gitlab.com/gnutls/gnutls/-/issues/1516

• Multiple vulnerabilities in GnuTLS
• Slackware Linux update for gnutls
• Fedora 40 update for gnutls
• Fedora 39 update for gnutls
• Fedora 38 update for gnutls
• Red Hat Enterprise Linux 8 update for gnutls
• openEuler update for gnutls
• SUSE update for gnutls
• Ubuntu update for gnutls28
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Red Hat Enterprise Linux 9 update for gnutls
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5
• Red Hat Enterprise Linux 8.8 Extended Update Support update for gnutls
• Red Hat Enterprise Linux 8.6 Extended Update Support update for gnutls
• Ubuntu update for gnutls28
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Red Hat Enterprise Linux 9 update for gnutls
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• SUSE update for gnutls
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Red Hat Enterprise Linux 9.2 Extended Update Support update for gnutls
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.6
• Multiple vulnerabilities in AMQ Broker 7.12
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Multiple vulnerabilities in Red Hat OpenStack 17.1 packages
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.33
• Multiple vulnerabilities in Service Interconnect 1.5
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat Ceph Storage 5
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for gnutls
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Amazon Linux AMI update for gnutls
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.8
• Multiple vulnerabilities in OpenShift Container Platform for Windows Containers 10.15
• Multiple vulnerabilities in IBM CICS TX Advanced
• Multiple vulnerabilities in IBM MQ
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in OpenShift Container Platform for Windows Containers 8.1
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in F5 Traffix SDC GnuTLS component
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.17
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in Enterprise SONiC Distribution
• Multiple vulnerabilities in Junos Space
• Multiple vulnerabilities in Dell OpenManage Network Integration (OMNI)
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.5
• Multiple vulnerabilities in Multicluster GlobalHub 1.2
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data - Execution Engine for Apache Hadoop
• Anolis OS update for gnutls
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Management Cloud Engine
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in Submariner 0.18
• Meinberg LANTIME firmware update for third-party components (April 2024)
• Gentoo update for GnuTLS
• Anolis OS update for gnutls
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift distributed tracing (RHOSDT) 3.2