一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

漏洞公开时间：

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):

2.openEuler-20.03-LTS-SP1(3.6.14):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(3.7.2):

5.openEuler-22.03-LTS-Next(3.7.2):

6.openEuler-22.03-LTS-SP1(3.7.2):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(3.7.8):

2.openEuler-20.03-LTS-SP1(3.6.14):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(3.7.2):

5.openEuler-22.03-LTS-Next(3.7.2):

6.openEuler-22.03-LTS-SP1(3.7.2):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):

2.openEuler-20.03-LTS-SP1(3.6.14):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(3.7.2):

5.openEuler-22.03-LTS-Next(3.7.2):

6.openEuler-22.03-LTS-SP1(3.7.2):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(3.7.8):

2.openEuler-20.03-LTS-SP1(3.6.14):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(3.7.2):

5.openEuler-22.03-LTS-Next(3.7.2):

6.openEuler-22.03-LTS-SP1(3.7.2):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):

2.openEuler-20.03-LTS-SP1(3.6.14):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(3.7.2):

5.openEuler-22.03-LTS-Next(3.7.2):

6.openEuler-22.03-LTS-SP1(3.7.2):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

修复是否涉及abi变化(是/否)：

1.master(3.7.8):

2.openEuler-20.03-LTS-SP1(3.6.14):

3.openEuler-20.03-LTS-SP4:

4.openEuler-22.03-LTS(3.7.2):

5.openEuler-22.03-LTS-Next(3.7.2):

6.openEuler-22.03-LTS-SP1(3.7.2):

7.openEuler-22.03-LTS-SP2:

8.openEuler-22.03-LTS-SP3:

9.openEuler-24.03-LTS:

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

受影响版本排查(受影响/不受影响)：

修复是否涉及abi变化(是/否)：

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

在GnuTLS中发现了一个漏洞。Minerva攻击是一种加密漏洞，利用类似GnuTLS的系统中的确定性行为，导致侧信道泄漏。在特定情况下，例如使用GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE标志时，它可能导致nonce大小从513位到512位的明显步骤，从而暴露潜在的时间侧信道。

openEuler评分：

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

10.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

10.openEuler-24.03-LTS-Next:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

10.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

10.openEuler-24.03-LTS-Next:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

10.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

10.openEuler-24.03-LTS-Next:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

10.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

10.openEuler-24.03-LTS-Next:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://access.redhat.com/security/cve/CVE-2024-28834 |

| cve_search | | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |

| cve_search | | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html |

| cve_search | | https://people.redhat.com/~hkario/marvin/ |

| mageia | | http://advisories.mageia.org/MGASA-2024-0089.html |

| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28834 | https://explore.alas.aws.amazon.com/CVE-2024-28834.html |

| snyk | https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

| snyk | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 | https://security.snyk.io/vuln/SNYK-UNMANAGED-GNUTLS-6478945 |

</details>

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

openBrain开源漏洞感知系统

漏洞补丁信息：

<details>

<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |

| ------- | -------- | ------- | -------- | --------- |

| | | https://github.com/gnutls/gnutls/commit/4a4cefef6c194f8fbbffd7fb19651219421b085b | | snyk |

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

5.3

Vector：CVSS：2.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

受影响版本排查(受影响/不受影响)：

1.master(3.7.8):受影响

2.openEuler-20.03-LTS-SP1(3.6.14):受影响

3.openEuler-20.03-LTS-SP4:受影响

4.openEuler-22.03-LTS(3.7.2):受影响

5.openEuler-22.03-LTS-Next(3.7.2):受影响

6.openEuler-22.03-LTS-SP1(3.7.2):受影响

7.openEuler-22.03-LTS-SP2:受影响

8.openEuler-22.03-LTS-SP3:受影响

9.openEuler-24.03-LTS:受影响

10.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否)：

1.master(3.7.8):否

2.openEuler-20.03-LTS-SP1(3.6.14):否

3.openEuler-20.03-LTS-SP4:否

4.openEuler-22.03-LTS(3.7.2):否

5.openEuler-22.03-LTS-Next(3.7.2):否

6.openEuler-22.03-LTS-SP1(3.7.2):否

7.openEuler-22.03-LTS-SP2:否

8.openEuler-22.03-LTS-SP3:否

9.openEuler-24.03-LTS:否

10.openEuler-24.03-LTS-Next:否

一、漏洞信息

漏洞编号：[CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834)

漏洞归属组件：[gnutls](https://gitee.com/src-openeuler/gnutls)

漏洞归属的版本：3.6.14,3.6.15,3.7.2,3.7.8,3.8.0

CVSS V2.0分值：

BaseScore：0.0 Low

Vector：CVSS：2.0/

漏洞简述：

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

漏洞公开时间：2024-03-21 22:15

漏洞创建时间：2024-03-21 18:30:41

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2024-28834

<details>

<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |

| ------- | -------- | -------- |

| redhat_bugzilla | https://minerva.crocs.fi.muni.cz | https://bugzilla.redhat.com/show_bug.cgi?id=2269228 |