It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.

gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery

Security update for gnutls

Affected: Ubuntu:Pro:14.04:LTS: gnutls26, Ubuntu:16.04:LTS: gnutls28, Ubuntu:18.04:LTS: gnutls28

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in GnuTLS ausnutzen, um Sicherheitsvorkehrungen zu umgehen.