CVE-2024-28834
MediumSummary
A flaw was found in GnuTLS related to the Minerva attack, a cryptographic vulnerability that exploits deterministic behavior, leading to side-channel leaks. In specific scenarios, such as using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce values.
Risk Assessment
An attacker can exploit side-channel information leakage to recover private keys, potentially compromising communication confidentiality.
Recommendation
Update GnuTLS to a version that removes the deterministic behavior enabling the Minerva attack, and avoid using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag.
Original NVD description (English source)
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce