CVE-2023-0361

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0361
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

7.4 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2023-0361 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-0361 Third Party Advisory
https://github.com/tlsfuzzer/tlsfuzzer/pull/679 Issue Tracking Patch
https://github.com/tlsfuzzer/tlsfuzzer/pull/679 Issue Tracking Patch
https://gitlab.com/gnutls/gnutls/-/issues/1050 Exploit Issue Tracking Vendor Advisory
https://gitlab.com/gnutls/gnutls/-/issues/1050 Exploit Issue Tracking Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00015.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00015.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFIA3X4IZ3CW7SRQ2UHNHNPMRIAWF2FI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFIA3X4IZ3CW7SRQ2UHNHNPMRIAWF2FI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS4KVDOG6QTALWHC2QE4Y7VPDRMLTRWQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS4KVDOG6QTALWHC2QE4Y7VPDRMLTRWQ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z634YBXAJ5VLDI62IOPBVP5K6YFHAWCY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z634YBXAJ5VLDI62IOPBVP5K6YFHAWCY/
https://security.netapp.com/advisory/ntap-20230324-0005/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20230324-0005/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20230725-0005/
https://security.netapp.com/advisory/ntap-20230725-0005/
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:gnutls:3.6.8-11.el8_2:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:converged_systems_advisor_agent:-:*:*:*:*:*:*:*
History

19 Mar 2025, 18:15

Type Values Removed Values Added
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230725-0005/ - () https://security.netapp.com/advisory/ntap-20230725-0005/ -
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230324-0005/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20230324-0005/ - Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2023/02/msg00015.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/02/msg00015.html - Mailing List, Third Party Advisory
References (MISC) https://github.com/tlsfuzzer/tlsfuzzer/pull/679 - Issue Tracking, Patch () https://github.com/tlsfuzzer/tlsfuzzer/pull/679 - Issue Tracking, Patch
References (MISC) https://access.redhat.com/security/cve/CVE-2023-0361 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-0361 - Third Party Advisory
References (MISC) https://gitlab.com/gnutls/gnutls/-/issues/1050 - Exploit, Issue Tracking, Vendor Advisory () https://gitlab.com/gnutls/gnutls/-/issues/1050 - Exploit, Issue Tracking, Vendor Advisory

07 Nov 2023, 04:00

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z634YBXAJ5VLDI62IOPBVP5K6YFHAWCY/', 'name': 'FEDORA-2023-5b378b82b3', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFIA3X4IZ3CW7SRQ2UHNHNPMRIAWF2FI/', 'name': 'FEDORA-2023-1c4a6a47ae', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS4KVDOG6QTALWHC2QE4Y7VPDRMLTRWQ/', 'name': 'FEDORA-2023-4fc4c33f2b', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFIA3X4IZ3CW7SRQ2UHNHNPMRIAWF2FI/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS4KVDOG6QTALWHC2QE4Y7VPDRMLTRWQ/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z634YBXAJ5VLDI62IOPBVP5K6YFHAWCY/ -

25 Jul 2023, 15:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20230725-0005/ -

23 May 2023, 17:22

Type Values Removed Values Added
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS4KVDOG6QTALWHC2QE4Y7VPDRMLTRWQ/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS4KVDOG6QTALWHC2QE4Y7VPDRMLTRWQ/ - Mailing List, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230324-0005/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20230324-0005/ - Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFIA3X4IZ3CW7SRQ2UHNHNPMRIAWF2FI/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFIA3X4IZ3CW7SRQ2UHNHNPMRIAWF2FI/ - Mailing List, Third Party Advisory
References (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z634YBXAJ5VLDI62IOPBVP5K6YFHAWCY/ - (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z634YBXAJ5VLDI62IOPBVP5K6YFHAWCY/ - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 7.4
CPE cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:converged_systems_advisor_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
First Time Netapp active Iq Unified Manager
Fedoraproject fedora
Netapp
Fedoraproject
Netapp converged Systems Advisor Agent
Netapp ontap Select Deploy Administration Utility
Information

Published : 2023-02-15 18:15

Updated : 2025-03-19 18:15

NVD link : CVE-2023-0361

Mitre link : CVE-2023-0361

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • enterprise_linux

fedoraproject

  • fedora

netapp

  • active_iq_unified_manager
  • ontap_select_deploy_administration_utility
  • converged_systems_advisor_agent

gnu

  • gnutls
CWE
CWE-203

Observable Discrepancy