UBUNTU-CVE-2018-10845

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2018-10845
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-10845.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2018-10845
Upstream
Downstream
Related
Published
2018-08-22T00:00:00Z
Modified
2025-10-30T04:53:47Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.

References

Affected packages

Ubuntu:14.04:LTS / gnutls26

Package

Name
gnutls26
Purl
pkg:deb/ubuntu/gnutls26@2.12.23-12ubuntu2.8?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.12.23-1ubuntu4
2.12.23-1ubuntu5
2.12.23-12ubuntu1
2.12.23-12ubuntu2
2.12.23-12ubuntu2.1
2.12.23-12ubuntu2.2
2.12.23-12ubuntu2.3
2.12.23-12ubuntu2.4
2.12.23-12ubuntu2.5
2.12.23-12ubuntu2.6
2.12.23-12ubuntu2.7
2.12.23-12ubuntu2.8

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gnutls-bin",
            "binary_version": "3.0.11+really2.12.23-12ubuntu2.8"
        },
        {
            "binary_name": "libgnutls-dev",
            "binary_version": "2.12.23-12ubuntu2.8"
        },
        {
            "binary_name": "libgnutls-openssl27",
            "binary_version": "2.12.23-12ubuntu2.8"
        },
        {
            "binary_name": "libgnutls26",
            "binary_version": "2.12.23-12ubuntu2.8"
        },
        {
            "binary_name": "libgnutlsxx27",
            "binary_version": "2.12.23-12ubuntu2.8"
        }
    ]
}

Ubuntu:16.04:LTS / gnutls28

Package

Name
gnutls28
Purl
pkg:deb/ubuntu/gnutls28@3.4.10-4ubuntu1.5?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.10-4ubuntu1.5

Affected versions

3.*

3.3.15-5ubuntu2
3.3.18-1ubuntu1
3.3.20-1ubuntu1
3.4.9-2ubuntu1
3.4.10-4ubuntu1
3.4.10-4ubuntu1.1
3.4.10-4ubuntu1.2
3.4.10-4ubuntu1.3
3.4.10-4ubuntu1.4

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "gnutls-bin",
            "binary_version": "3.4.10-4ubuntu1.5"
        },
        {
            "binary_name": "guile-gnutls",
            "binary_version": "3.4.10-4ubuntu1.5"
        },
        {
            "binary_name": "libgnutls-dev",
            "binary_version": "3.4.10-4ubuntu1.5"
        },
        {
            "binary_name": "libgnutls-openssl27",
            "binary_version": "3.4.10-4ubuntu1.5"
        },
        {
            "binary_name": "libgnutls28-dev",
            "binary_version": "3.4.10-4ubuntu1.5"
        },
        {
            "binary_name": "libgnutls30",
            "binary_version": "3.4.10-4ubuntu1.5"
        },
        {
            "binary_name": "libgnutlsxx28",
            "binary_version": "3.4.10-4ubuntu1.5"
        }
    ]
}

Ubuntu:18.04:LTS / gnutls28

Package

Name
gnutls28
Purl
pkg:deb/ubuntu/gnutls28@3.5.18-1ubuntu1.1?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.18-1ubuntu1.1

Affected versions

3.*

3.5.8-6ubuntu3
3.5.17-1ubuntu1
3.5.17-1ubuntu3
3.5.18-1ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "gnutls-bin",
            "binary_version": "3.5.18-1ubuntu1.1"
        },
        {
            "binary_name": "libgnutls-dane0",
            "binary_version": "3.5.18-1ubuntu1.1"
        },
        {
            "binary_name": "libgnutls-openssl27",
            "binary_version": "3.5.18-1ubuntu1.1"
        },
        {
            "binary_name": "libgnutls28-dev",
            "binary_version": "3.5.18-1ubuntu1.1"
        },
        {
            "binary_name": "libgnutls30",
            "binary_version": "3.5.18-1ubuntu1.1"
        },
        {
            "binary_name": "libgnutlsxx28",
            "binary_version": "3.5.18-1ubuntu1.1"
        }
    ]
}

Ubuntu:Pro:FIPS-updates:24.04:LTS / gnutls28

Package

Name
gnutls28
Purl
pkg:deb/ubuntu/gnutls28@3.8.3-1.1ubuntu3.4+Fips1.1?arch=source&distro=fips-updates/noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.8.3-1.1ubuntu3.1+Fips1
3.8.3-1.1ubuntu3.4+Fips1
3.8.3-1.1ubuntu3.4+Fips1.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gnutls-bin",
            "binary_version": "3.8.3-1.1ubuntu3.4+Fips1.1"
        },
        {
            "binary_name": "libgnutls-dane0t64",
            "binary_version": "3.8.3-1.1ubuntu3.4+Fips1.1"
        },
        {
            "binary_name": "libgnutls-openssl27t64",
            "binary_version": "3.8.3-1.1ubuntu3.4+Fips1.1"
        },
        {
            "binary_name": "libgnutls28-dev",
            "binary_version": "3.8.3-1.1ubuntu3.4+Fips1.1"
        },
        {
            "binary_name": "libgnutls30t64",
            "binary_version": "3.8.3-1.1ubuntu3.4+Fips1.1"
        }
    ]
}