CVE-2018-10844

Public on 2018-08-22
Modified on 2018-12-08
Description
It was found that GnuTLS's implementation of HMAC-SHA-256 was vulnerable to Lucky Thirteen-style attack. A remote attacker could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.
Severity
Medium severity
Medium
CVSS v3 Base Score
5.9
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core gnutls 2018-12-06 ALAS2-2018-1120 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD CVSSv2 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
NVD CVSSv3 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N