This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-10846 →

DEBIAN-CVE-2018-10846

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a co...

Original description

The description as published by the source.

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 gnutls28

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-1"}]}]

Debian:13 gnutls28

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-1"}]}]

Debian:14 gnutls28

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-1"}]}]

References

advisory security-tracker.debian.org