CVE-2018-16868

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.6.5

Description The issue is related to an error in verifying decrypted RSA data, allowing an attacker to potentially access protected information through a side-channel cache attack. Specifically, a Bleichenbacher type side-channel based padding oracle attack was found in the way GnuTLS handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who can run a process on the same physical core as the victim process could exploit this to extract plaintext or, in some cases, downgrade any TLS connections to a vulnerable server.

Recommendations For GnuTLS versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing the use of TLS connections to vulnerable servers until the update can be applied.