CVE-2024-28834: Gnutls: vulnerable to minerva side-channel information leak
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28834?
CVE-2024-28834 has been classified as a significant cryptographic vulnerability due to its potential for side-channel attacks.
How do I fix CVE-2024-28834?
To fix CVE-2024-28834, upgrade to GnuTLS versions 3.6.13-2ubuntu1.11 or later for Ubuntu, or to appropriate versions provided by other distributions like Debian and Red Hat.
What systems are affected by CVE-2024-28834?
CVE-2024-28834 affects various GnuTLS implementations across different platforms, including specific versions on Ubuntu, Debian, and Red Hat.
What are the consequences of CVE-2024-28834 if exploited?
If exploited, CVE-2024-28834 can lead to information leakage through side-channel attacks, potentially compromising sensitive data.
Is there a workaround for CVE-2024-28834?
Currently, the best approach for CVE-2024-28834 is to update to the latest GnuTLS versions, as no specific workarounds are recommended.