SUSE-SU-2023:4983-1

MEDIUM5.9

Security update for gnutls

Published Dec 28, 2023

Modified 2 years ago

Fix available

Details

Description of the patch:

This update for gnutls fixes the following issues:

CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

Affected Packages

gnutls

SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise Micro 5.4

Fixed in:

3.7.3-150400.4.38.1

libgnutls-devel

Fixed in:

3.7.3-150400.4.38.1

libgnutls30

Fixed in:

3.7.3-150400.4.38.1

libgnutls30-32bit

Fixed in:

3.7.3-150400.4.38.1

libgnutls30-hmac

Fixed in:

3.7.3-150400.4.38.1

libgnutls30-hmac-32bit

Fixed in:

3.7.3-150400.4.38.1

libgnutlsxx-devel

Fixed in:

3.7.3-150400.4.38.1

libgnutlsxx28

Fixed in:

3.7.3-150400.4.38.1

gnutls-guile

openSUSE Leap 15.4openSUSE Leap 15.5

Fixed in:

3.7.3-150400.4.38.1

libgnutls-devel-32bit

openSUSE Leap 15.4openSUSE Leap 15.5

Fixed in:

3.7.3-150400.4.38.1

References

ADVISORY

https://bugzilla.suse.com/1217277

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2023-December/017571.html

ADVISORY

https://www.suse.com/security/cve/CVE-2023-5981/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2023/suse-su-20234983-1/

CVSS Analysis

CVSS v3.1

5.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.9/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Upstream

CVE-2023-5981

Ecosystems(18)

SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Micro 5.4

Timeline

PublishedDec 28, 2023

ModifiedDec 28, 2023

SUSE-SU-2023:4983-1 | Mondoo Vulnerability Intelligence