Security readout for executives and security teams
Plain-English summary
GnuTLS had a timing leak during RSA TLS handshakes. A remote attacker could potentially recover the secret from a connection and decrypt or alter that session, but the attack requires many crafted messages and favorable conditions. This is important for exposed services using affected GnuTLS builds.
Executive priority
Treat as a high-priority patching item for exposed TLS services, especially internet-facing systems. The attack is not described as actively exploited, but successful exploitation could compromise confidentiality and integrity of a TLS session.
Technical view
CVE-2023-0361 is a CWE-203 timing side channel in GnuTLS handling of RSA ClientKeyExchange messages. Sources describe a Bleichenbacher-style network attack that can recover the key encrypted in RSA ciphertext for a connection. CVSS is 7.4 high with high attack complexity and no privileges or user interaction required.
Likely exposure
Exposure is most likely on servers using affected GnuTLS packages, explicitly including gnutls-3.7.6 in the bundle, where TLS handshakes using RSA ClientKeyExchange are reachable over the network. Downstream advisories from Debian, Fedora, Red Hat, and NetApp indicate package and product impact should be checked per vendor.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The described attack is remote but high complexity because it requires a large volume of specially crafted messages to a vulnerable server and only affects data for the targeted connection.
Researcher notes
Do not assume all TLS stacks are affected; this is specific to GnuTLS handling of RSA ClientKeyExchange. The bundle names gnutls-3.7.6 and links distribution advisories, but does not provide a complete fixed-version matrix. Validate impact through vendor package metadata.
Mitigation direction
- Apply vendor security updates for GnuTLS or downstream packages.
- Check Red Hat, Debian, Fedora, and NetApp advisories for affected versions.
- Prioritize internet-facing TLS services using GnuTLS.
- Follow vendor guidance where fixed versions or configuration mitigations are specified.
Validation and detection
- Inventory systems and products that include GnuTLS.
- Confirm installed GnuTLS package versions against vendor advisories.
- Identify externally reachable TLS services backed by GnuTLS.
- Review TLS logs for unusual high-volume handshake failures.
- Document systems where vendor impact is still undetermined.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-203: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-0361 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N2.25.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://access.redhat.com/security/cve/CVE-2023-0361CVE reference
- https://github.com/tlsfuzzer/tlsfuzzer/pull/679CVE reference
- https://gitlab.com/gnutls/gnutls/-/issues/1050CVE reference
- [debian-lts-announce] 20230218 [SECURITY] [DLA 3321-1] gnutls28 security updateCVE reference · mailing-list
- FEDORA-2023-1c4a6a47aeCVE reference · vendor-advisory
- FEDORA-2023-5b378b82b3CVE reference · vendor-advisory
- FEDORA-2023-4fc4c33f2bCVE reference · vendor-advisory
- https://security.netapp.com/advisory/ntap-20230324-0005/CVE reference
- https://security.netapp.com/advisory/ntap-20230725-0005/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Observable Discrepancy
Observable Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.