gnutls: information disclosure [LWN.net]

Package(s):

gnutls

CVE #(s):

CVE-2012-0390

Created:

March 9, 2012

Updated:

August 7, 2012

Description:

From the CVE entry:

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.

Alerts:

openSUSE	openSUSE-SU-2012:0344-1	2012-03-09
Mageia	MGASA-2012-0202	2012-08-06

(Log in to post comments)