CVE-2018-16869

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Score

CVSS 3.1 5.7 Medium

Status

Modified - secalert@redhat.com

Published

2018-12-03

Last modified

2024-08-05

Weaknesses

CWE-203

Affected products

• Nettle (Nettle Project)
• Nettle (Unknown)

References

• http://cat.eyalro.net/
• http://www.securityfocus.com/bid/106092
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16869