Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2024-28834: A flaw was found in GnuTLS

32
Routine
MEDIUM 5.3

CVE-2024-28834 is a medium-severity flaw (CVSS 5.3) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score5.3 (Medium)
Attack vectorNetwork (remote)
Attack complexityHigh
Privileges neededLow
User interactionNone
EPSS exploit chance0.7% (top 46%)
CISA exploited listNo
WeaknessCWE-327
Published2024-03-21
Last modified2026-10-22
Publisher (CNA): Red Hat, Inc.

Last updated 2026-10-22 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

Exact fixes by distribution

Fedora 46 · wasmedge · FIXED · 0.18.1-1.fc46 · FEDORA-2026-4c27216e39 · source
sudo dnf upgrade --advisory=FEDORA-2026-4c27216e39
Debian 12 · gnutls28 · FIXED · 3.7.9-2+deb12u3
sudo apt update && sudo apt install --only-upgrade gnutls28 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' gnutls28)" ge "3.7.9-2+deb12u3" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · gnutls28 · FIXED · 3.8.4-2
sudo apt update && sudo apt install --only-upgrade gnutls28 dpkg --compare-versions "$(dpkg-query -W -f='${Version}' gnutls28)" ge "3.8.4-2" && echo PATCHED || echo STILL-VULNERABLE
RHEL 8 · gnutls · FIXED · gnutls-3.6.16-8.el8_9.3
sudo dnf upgrade --advisory=RHSA-2024:1784 rpm -q gnutls
RHEL 8.6 Extended Update Support · gnutls · FIXED · gnutls-3.6.16-5.el8_6.4
sudo dnf upgrade --advisory=RHSA-2024:2044 rpm -q gnutls
RHEL 8.8 Extended Update Support · gnutls · FIXED · gnutls-3.6.16-7.el8_8.3
sudo dnf upgrade --advisory=RHSA-2024:1997 rpm -q gnutls
RHEL 9 · gnutls · FIXED · gnutls-3.7.6-23.el9_3.4
sudo dnf upgrade --advisory=RHSA-2024:1879 rpm -q gnutls
RHEL 9.2 Extended Update Support · gnutls · FIXED · gnutls-3.7.6-21.el9_2.3
sudo dnf upgrade --advisory=RHSA-2024:2889 rpm -q gnutls
Alpine 3.20 · gnutls · FIXED · gnutls-3.8.5-r0
apk add --upgrade gnutls apk info -v gnutls
Alpine 3.21 · gnutls · FIXED · gnutls-3.8.5-r0
apk add --upgrade gnutls apk info -v gnutls
Alpine 3.22 · gnutls · FIXED · gnutls-3.8.5-r0
apk add --upgrade gnutls apk info -v gnutls
Alpine 3.23 · gnutls · FIXED · gnutls-3.8.5-r0
apk add --upgrade gnutls apk info -v gnutls
Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2024-591 · source
sudo dnf update --advisory=ALAS2023-2024-591

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-28834?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2024-28834 being exploited?

CVE-2024-28834 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-28834 affect?

CVE-2024-28834 affects affected software. Severity is medium (CVSS 5.3). A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_RE

How urgent is CVE-2024-28834?

Priority 32/100. No elevated risk signals yet.

References

← Back to latest CVEs