CVE-2024-28834: gnutls
Vulnerability summary
CVE-2024-28834 is a medium (CVSS 5.3) vulnerability in gnutls. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 13 · Related 8Timeline
- 21-03-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.72% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat10 products
- gnutls< 0:3.6.16-8.el8_9.3 | < 0:3.6.16-7.el8_8.3 | < 0:3.6.16-5.el8_6.4
- gnutls-c++< 0:3.6.16-8.el8_9.3 | < 0:3.6.16-7.el8_8.3 | < 0:3.6.16-5.el8_6.4
- gnutls-c++-debuginfo< 0:3.6.16-8.el8_9.3 | < 0:3.6.16-7.el8_8.3 | < 0:3.6.16-5.el8_6.4
- gnutls-dane< 0:3.6.16-8.el8_9.3 | < 0:3.6.16-7.el8_8.3 | < 0:3.6.16-5.el8_6.4
- gnutls-dane-debuginfo< 0:3.6.16-8.el8_9.3 | < 0:3.6.16-7.el8_8.3 | < 0:3.6.16-5.el8_6.4
Alpine1 product
- gnutls< 3.8.4-r0 | < 3.8.5-r0
Debian1 product
- gnutls28< 3.7.9-2+deb12u3 | < 3.8.4-2
Ubuntu1 product
- gnutls28< 3.6.13-2ubuntu1.11 | < 3.7.3-4ubuntu1.5 | < 3.8.3-1.1ubuntu3.1
4 vendors · 13 products
References
28 links- minerva.crocs.fi.muni.czARTICLE
Show all 28 references
- www.openwall.com/lists/oss-security/2024/03/22/1X Transferred
- www.openwall.com/lists/oss-security/2024/03/22/2X Transferred
- security.netapp.com/advisory/ntap-20240524-0004/X Transferred
