CVE-2018-10844

Published: 22 August 2018

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.

Priority

CVSS 3 base score: 5.9

Status

Package	Release	Status
gnutls26 Launchpad, Ubuntu, Debian	Upstream	Needs triage

	Ubuntu 21.04 (Hirsute Hippo)	Does not exist
	Ubuntu 20.10 (Groovy Gorilla)	Does not exist
	Ubuntu 20.04 LTS (Focal Fossa)	Does not exist
	Ubuntu 18.04 LTS (Bionic Beaver)	Does not exist
	Ubuntu 16.04 ESM (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Needs triage
gnutls28 Launchpad, Ubuntu, Debian	Upstream	Released (3.5.19,3.6.3)

	Ubuntu 21.04 (Hirsute Hippo)	Not vulnerable (3.6.5-2ubuntu1)
	Ubuntu 20.10 (Groovy Gorilla)	Not vulnerable (3.6.5-2ubuntu1)
	Ubuntu 20.04 LTS (Focal Fossa)	Not vulnerable (3.6.5-2ubuntu1)
	Ubuntu 18.04 LTS (Bionic Beaver)	Released (3.5.18-1ubuntu1.1)
	Ubuntu 16.04 ESM (Xenial Xerus)	Released (3.4.10-4ubuntu1.5)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was needed)
	Patches: Upstream: https://gitlab.com/gnutls/gnutls/merge_requests/657 Upstream: https://gitlab.com/gnutls/gnutls/commit/e14d85eb8b1987d86f7b1d101a0e7795675d20d4 (3.5) Upstream: https://gitlab.com/gnutls/gnutls/commit/c2e094acd68f7159025b2e2556d6fb4427b41dd7 (3.5) Upstream: https://gitlab.com/gnutls/gnutls/commit/62a39773e9d0c4a686a3d8d2b6cca32f82c26cd7 (3.5) Upstream: https://gitlab.com/gnutls/gnutls/commit/c433cdf92349afae66c703bdacedf987f423605e (3.5) Upstream: https://gitlab.com/gnutls/gnutls/commit/9fdd24d53c84cc68dac1be28f8b1436e424ce1f1 (3.5)

Notes

Author	Note
mdeslaur	RHEL7 update brings back SHA256

References

Bugs

https://gitlab.com/gnutls/gnutls/issues/456

CVE-2018-10844

Medium

Status

Notes

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Further reading