CVE-2023-5981

Note

in order to backport the patch for this CVE for xenial and earlier
it is necessary to also include the changes from commit 4804febdd,
which is also the fix for CVE-2018-16868, due to the use of function
'gnutls_privkey_decrypt_data2' in the patch. However, to successfully
add the fix for CVE-2018-16868 it is required that the patch for
CVE-2018-16869 also be applied to nettle, which is not possible for
xenial and earlier due to it being too intrusive. Therefore, it will
not be possible to patch CVE-2023-5981 in xenial and earlier because
it would also be considered too intrusive in this case.

Package	Release	Status
gnutls28 Launchpad, Ubuntu, Debian	bionic	Released (3.5.18-1ubuntu1.6+esm1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	focal	Released (3.6.13-2ubuntu1.9)
	jammy	Released (3.7.3-4ubuntu1.3)
	lunar	Released (3.7.8-5ubuntu1.1)
	mantic	Released (3.8.1-4ubuntu1.1)
	trusty	Ignored (end of standard support)
	upstream	Released (3.8.2)
	xenial	Ignored (change too intrusive)
	Patches: upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/1787/diffs?commit_id=29d6298d0b04cfff970b993915db71ba3f580b6d

Parameter	Value
Base score	5.9
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVE-2023-5981

Notes

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading