Critical Cryptographic Vulnerability in GnuTLS: The Minerva Attack
Summary
ALPINE-CVE-2024-28834: A flaw was found in GnuTLS. Affects gnutls versions < 3.8.4-r0. Fixed in 3.8.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GnuTLS is a secure communications library that implements the SSL, TLS, and DTLS protocols. It is widely used in various applications to provide secure network communications. GnuTLS supports a range of cryptographic algorithms and protocols, making it a versatile choice for developers. However, it is susceptible to specific vulnerabilities, including the Minerva attack, which exploits deterministic behavior in cryptographic operations, potentially leading to side-channel leaks.
Vulnerability Detail
A flaw was found in GnuTLS related to the Minerva attack, a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS. This vulnerability can lead to side-channel leaks, particularly when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag. In certain scenarios, this can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel that can be exploited by attackers to gain sensitive information.
How To Fix
Minimum fixed version
3.8.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade gnutlsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider avoiding the use of the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag in your applications to mitigate the risk of the Minerva attack until a proper update can be applied.
Conclusion
The GnuTLS library has a critical vulnerability related to the Minerva attack, which can lead to serious security implications. It is crucial for users to update to the patched versions as soon as possible and consider workarounds if immediate updates are not feasible. Regular monitoring of vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for gnutls →
FAQ
The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to potential side-channel leaks.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
Exploiting this vulnerability can allow attackers to gain sensitive information through timing side-channels, potentially compromising the security of the application.
Yes, patches are available for various versions of GnuTLS. It is recommended to update to the latest fixed version as outlined in the 'how to fix' section.
If an immediate update is not possible, avoid using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag in your applications as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for gnutls.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
