cve/2024/CVE-2024-28834.md

CVE-2024-28834

Description

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

POC

Reference

• https://minerva.crocs.fi.muni.cz/

Github

• https://github.com/GitHubForSnap/ssmtp-gael
• https://github.com/GrigGM/05-virt-04-docker-hw
• https://github.com/NaInSec/CVE-LIST
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/m-pasima/CI-CD-Security-image-scan