OESA-2023-1126

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1126
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1126.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2023-1126
Upstream
Published
2023-02-24T11:04:58Z
Modified
2025-09-03T06:18:46.567671Z
Summary
gnutls security update
Details

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface (API) to access the secure communications protocols as well as APIs to parse and write X.509, PKCS #12, and other required structures. The project strives to provide a secure communications back-end, simple to use and integrated with the rest of the base Linux libraries. A back-end designed to work and be secure out of the box, keeping the complexity of TLS and PKI out of application code.

Security Fix(es):

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.(CVE-2023-0361)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / gnutls

Package

Name
gnutls
Purl
pkg:rpm/openEuler/gnutls&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.14-11.oe1

Ecosystem specific 

{
    "src": [
        "gnutls-3.6.14-11.oe1.src.rpm"
    ],
    "x86_64": [
        "gnutls-utils-3.6.14-11.oe1.x86_64.rpm",
        "gnutls-3.6.14-11.oe1.x86_64.rpm",
        "gnutls-devel-3.6.14-11.oe1.x86_64.rpm",
        "gnutls-debuginfo-3.6.14-11.oe1.x86_64.rpm",
        "gnutls-debugsource-3.6.14-11.oe1.x86_64.rpm"
    ],
    "noarch": [
        "gnutls-help-3.6.14-11.oe1.noarch.rpm"
    ],
    "aarch64": [
        "gnutls-utils-3.6.14-11.oe1.aarch64.rpm",
        "gnutls-debuginfo-3.6.14-11.oe1.aarch64.rpm",
        "gnutls-debugsource-3.6.14-11.oe1.aarch64.rpm",
        "gnutls-devel-3.6.14-11.oe1.aarch64.rpm",
        "gnutls-3.6.14-11.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP3 / gnutls

Package

Name
gnutls
Purl
pkg:rpm/openEuler/gnutls&distro=openEuler-20.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.14-10.oe1

Ecosystem specific 

{
    "src": [
        "gnutls-3.6.14-10.oe1.src.rpm"
    ],
    "x86_64": [
        "gnutls-3.6.14-10.oe1.x86_64.rpm",
        "gnutls-devel-3.6.14-10.oe1.x86_64.rpm",
        "gnutls-debugsource-3.6.14-10.oe1.x86_64.rpm",
        "gnutls-debuginfo-3.6.14-10.oe1.x86_64.rpm"
    ],
    "noarch": [
        "gnutls-help-3.6.14-10.oe1.noarch.rpm"
    ],
    "aarch64": [
        "gnutls-debugsource-3.6.14-10.oe1.aarch64.rpm",
        "gnutls-debuginfo-3.6.14-10.oe1.aarch64.rpm",
        "gnutls-3.6.14-10.oe1.aarch64.rpm",
        "gnutls-devel-3.6.14-10.oe1.aarch64.rpm"
    ]
}

openEuler:22.03-LTS / gnutls

Package

Name
gnutls
Purl
pkg:rpm/openEuler/gnutls&distro=openEuler-22.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.7.2-7.oe2203sp1

Ecosystem specific 

{
    "src": [
        "gnutls-3.7.2-7.oe2203.src.rpm",
        "gnutls-3.7.2-7.oe2203sp1.src.rpm"
    ],
    "x86_64": [
        "gnutls-devel-3.7.2-7.oe2203.x86_64.rpm",
        "gnutls-3.7.2-7.oe2203.x86_64.rpm",
        "gnutls-utils-3.7.2-7.oe2203.x86_64.rpm",
        "gnutls-debugsource-3.7.2-7.oe2203.x86_64.rpm",
        "gnutls-debuginfo-3.7.2-7.oe2203.x86_64.rpm",
        "gnutls-utils-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-debuginfo-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-debugsource-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-devel-3.7.2-7.oe2203sp1.x86_64.rpm"
    ],
    "noarch": [
        "gnutls-help-3.7.2-6.oe2203.noarch.rpm",
        "gnutls-help-3.7.2-7.oe2203.noarch.rpm",
        "gnutls-help-3.7.2-7.oe2203sp1.noarch.rpm"
    ],
    "aarch64": [
        "gnutls-utils-3.7.2-7.oe2203.aarch64.rpm",
        "gnutls-debugsource-3.7.2-7.oe2203.aarch64.rpm",
        "gnutls-devel-3.7.2-7.oe2203.aarch64.rpm",
        "gnutls-3.7.2-7.oe2203.aarch64.rpm",
        "gnutls-debuginfo-3.7.2-7.oe2203.aarch64.rpm",
        "gnutls-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-utils-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-debugsource-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-devel-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-debuginfo-3.7.2-7.oe2203sp1.aarch64.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / gnutls

Package

Name
gnutls
Purl
pkg:rpm/openEuler/gnutls&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.7.2-7.oe2203sp1

Ecosystem specific 

{
    "src": [
        "gnutls-3.7.2-7.oe2203sp1.src.rpm"
    ],
    "x86_64": [
        "gnutls-utils-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-debuginfo-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-debugsource-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-3.7.2-7.oe2203sp1.x86_64.rpm",
        "gnutls-devel-3.7.2-7.oe2203sp1.x86_64.rpm"
    ],
    "noarch": [
        "gnutls-help-3.7.2-7.oe2203sp1.noarch.rpm"
    ],
    "aarch64": [
        "gnutls-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-utils-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-debugsource-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-devel-3.7.2-7.oe2203sp1.aarch64.rpm",
        "gnutls-debuginfo-3.7.2-7.oe2203sp1.aarch64.rpm"
    ]
}