CVE-2018-16869

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.7 MEDIUM
PHYSICAL
HIGH
NONE
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
Affected Products (NVD)
VendorProductVersion
nettle_projectnettle
𝑥
≤ 3.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nettle
bookworm
3.8.1-2
fixed
bullseye
3.7.3-1
fixed
sid
3.10-1
fixed
stretch
no-dsa
trixie
3.10-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nettle
bionic
Fixed 3.4.1-0ubuntu0.18.04.1
released
cosmic
ignored
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
trusty
ignored
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libhogweed4
suse enterprise desktop 15
3.4-4.3.1
fixed
suse enterprise desktop 15 SP1
3.4-4.3.1
fixed
suse enterprise desktop 15 SP2
3.4-4.3.1
fixed
suse enterprise desktop 15 SP3
3.4-4.3.1
fixed
suse enterprise sap 15
3.4-4.3.1
fixed
suse enterprise sap 15 SP1
3.4-4.3.1
fixed
suse enterprise sap 15 SP2
3.4-4.3.1
fixed
suse enterprise sap 15 SP3
3.4-4.3.1
fixed
suse enterprise server 15
3.4-4.3.1
fixed
suse enterprise server 15 SP1
3.4-4.3.1
fixed
suse enterprise server 15 SP2
3.4-4.3.1
fixed
suse enterprise server 15 SP3
3.4-4.3.1
fixed
libhogweed4-32bit
suse enterprise desktop 15
3.4-4.3.1
fixed
suse enterprise desktop 15 SP1
3.4-4.3.1
fixed
suse enterprise desktop 15 SP2
3.4-4.3.1
fixed
suse enterprise desktop 15 SP3
3.4-4.3.1
fixed
suse enterprise sap 15
3.4-4.3.1
fixed
suse enterprise sap 15 SP1
3.4-4.3.1
fixed
suse enterprise sap 15 SP2
3.4-4.3.1
fixed
suse enterprise sap 15 SP3
3.4-4.3.1
fixed
suse enterprise server 15
3.4-4.3.1
fixed
suse enterprise server 15 SP1
3.4-4.3.1
fixed
suse enterprise server 15 SP2
3.4-4.3.1
fixed
suse enterprise server 15 SP3
3.4-4.3.1
fixed
libhogweed6
suse enterprise desktop 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise desktop 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise desktop 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise desktop 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise sap 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise sap 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise sap 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise server 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise server 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise server 15 SP7
3.10.1-150700.2.16
fixed
libhogweed6-32bit
suse enterprise desktop 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise desktop 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise desktop 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise desktop 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise sap 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise sap 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise sap 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise server 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise server 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise server 15 SP7
3.10.1-150700.2.16
fixed
libnettle-devel
suse enterprise desktop 15
3.4-4.3.1
fixed
suse enterprise desktop 15 SP1
3.4-4.3.1
fixed
suse enterprise desktop 15 SP2
3.4-4.3.1
fixed
suse enterprise desktop 15 SP3
3.4-4.3.1
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise desktop 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise desktop 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise desktop 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise sap 15
3.4-4.3.1
fixed
suse enterprise sap 15 SP1
3.4-4.3.1
fixed
suse enterprise sap 15 SP2
3.4-4.3.1
fixed
suse enterprise sap 15 SP3
3.4-4.3.1
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise sap 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise sap 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise sap 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise server 15
3.4-4.3.1
fixed
suse enterprise server 15 SP1
3.4-4.3.1
fixed
suse enterprise server 15 SP2
3.4-4.3.1
fixed
suse enterprise server 15 SP3
3.4-4.3.1
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise server 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise server 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise server 15 SP7
3.10.1-150700.2.16
fixed
libnettle6
suse enterprise desktop 15
3.4-4.3.1
fixed
suse enterprise desktop 15 SP1
3.4-4.3.1
fixed
suse enterprise desktop 15 SP2
3.4-4.3.1
fixed
suse enterprise desktop 15 SP3
3.4-4.3.1
fixed
suse enterprise sap 15
3.4-4.3.1
fixed
suse enterprise sap 15 SP1
3.4-4.3.1
fixed
suse enterprise sap 15 SP2
3.4-4.3.1
fixed
suse enterprise sap 15 SP3
3.4-4.3.1
fixed
suse enterprise server 15
3.4-4.3.1
fixed
suse enterprise server 15 SP1
3.4-4.3.1
fixed
suse enterprise server 15 SP2
3.4-4.3.1
fixed
suse enterprise server 15 SP3
3.4-4.3.1
fixed
libnettle6-32bit
suse enterprise desktop 15
3.4-4.3.1
fixed
suse enterprise desktop 15 SP1
3.4-4.3.1
fixed
suse enterprise desktop 15 SP2
3.4-4.3.1
fixed
suse enterprise desktop 15 SP3
3.4-4.3.1
fixed
suse enterprise sap 15
3.4-4.3.1
fixed
suse enterprise sap 15 SP1
3.4-4.3.1
fixed
suse enterprise sap 15 SP2
3.4-4.3.1
fixed
suse enterprise sap 15 SP3
3.4-4.3.1
fixed
suse enterprise server 15
3.4-4.3.1
fixed
suse enterprise server 15 SP1
3.4-4.3.1
fixed
suse enterprise server 15 SP2
3.4-4.3.1
fixed
suse enterprise server 15 SP3
3.4-4.3.1
fixed
libnettle8
suse enterprise desktop 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise desktop 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise desktop 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise desktop 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise sap 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise sap 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise sap 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise server 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise server 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise server 15 SP7
3.10.1-150700.2.16
fixed
libnettle8-32bit
suse enterprise desktop 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise desktop 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise desktop 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise desktop 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise sap 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise sap 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise sap 15 SP7
3.10.1-150700.2.16
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.21
fixed
suse enterprise server 15 SP5
3.8.1-150500.2.25
fixed
suse enterprise server 15 SP6
3.9.1-150600.1.46
fixed
suse enterprise server 15 SP7
3.10.1-150700.2.16
fixed
Common Weakness Enumeration
References
http://cat.eyalro.net/
http://www.securityfocus.com/bid/106092
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16869
http://cat.eyalro.net/
http://www.securityfocus.com/bid/106092
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16869