CVE-2024-0553: fedoraproject fedora Observable Discrepancy
Vulnerability summary
CVE-2024-0553 is a high (CVSS 7.5) Observable Discrepancy vulnerability in fedoraproject fedora. EPSS estimates a 1.61% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 10 · Related 7Timeline
- 16-01-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.61%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
0.00 pp
From 1.61% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat11 products
- enterprise_linux8.0 | 9.0
- gnutls< 0:3.6.16-8.el8_9.1 | < 0:3.6.16-7.el8_8.2 | < 0:3.6.16-5.el8_6.3
- gnutls-c++< 0:3.6.16-8.el8_9.1 | < 0:3.6.16-7.el8_8.2 | < 0:3.6.16-5.el8_6.3
- gnutls-c++-debuginfo< 0:3.6.16-8.el8_9.1 | < 0:3.6.16-7.el8_8.2 | < 0:3.6.16-5.el8_6.3
- gnutls-dane< 0:3.6.16-8.el8_9.1 | < 0:3.6.16-7.el8_8.2 | < 0:3.6.16-5.el8_6.3
Alpine1 product
- gnutls< 3.8.3-r0
Debian1 product
- gnutls28< 3.6.7-4+deb10u12 | < 3.7.9-2+deb12u2 | < 3.8.3-1
Fedoraproject1 product
- fedoraEOL39
Gnu1 product
- gnutls< 3.8.3
Ubuntu1 product
- gnutls28All versions (No fix recorded) | < 3.5.18-1ubuntu1.6+esm3 | < 3.6.13-2ubuntu1.10 | < 3.7.3-4ubuntu1.4 | < 3.8.3-1ubuntu1
6 vendors · 16 products
References
29 links- bugzilla.redhat.com/show_bug.cgi?id=2258412Issue TrackingX Refsource REDHATREPORTThird Party Advisory
Show all 29 references
- www.openwall.com/lists/oss-security/2024/01/19/3X Transferred
- lists.fedoraproject.org/archives/…X Transferred
- lists.fedoraproject.org/archives/…X Transferred
- security.netapp.com/advisory/ntap-20240202-0011/X Transferred
