Fluid Attacks Database

Description

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	gnutls28	>=0 <3.8.4-2	3.8.4-2
alpine v3.20	gnutls	>=0 <3.8.5-r0	3.8.5-r0
alpine v3.22	gnutls	>=0 <3.8.5-r0	3.8.5-r0
alpine v3.18	gnutls	>=0 <3.8.4-r0	3.8.4-r0
alpine v3.19	gnutls	>=0 <3.8.4-r0	3.8.4-r0
alpine v3.21	gnutls	>=0 <3.8.5-r0	3.8.5-r0
debian 11	gnutls28	=3.7.1-5 \|\| =3.7.1-5+deb11u1 \|\| =3.7.1-5+deb11u2 \|\| =3.7.1-5+deb11u3 \|\| =3.7.1-5+deb11u4 \|\| =3.7.1-5+deb11u5 \|\| >=0 <3.7.1-5+deb11u6	3.7.1-5+deb11u6
debian 12	gnutls28	=3.7.9-2 \|\| =3.7.9-2+deb12u1 \|\| =3.7.9-2+deb12u2 \|\| >=0 <3.7.9-2+deb12u3	3.7.9-2+deb12u3
debian 14	gnutls28	>=0 <3.8.4-2	3.8.4-2
alpine v3.23	gnutls	>=0 <3.8.5-r0	3.8.5-r0

1-10 of 19

Aliases

1. CVE-2024-288342. NVD-2024-288343. OSV-DEBIAN-2024-288344. OSV-2024-288345. OSV-ALPINE-2024-288346. SECURITY-TRACKER-CVE-2024-288347. SECURITY-CVE-2024-28834

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.