boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-0553

CVE-2024-0553HIGH
Gnutls: incomplete fix for cve-2023-5981
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0161   75.6     —
AFFECTED
  Product                                               Versions     Fixed
  gnutls                                                3.8.0 –      —
  Red Hat Enterprise Linux 8                            unspecified  0:3.6.16-8.el8_9.1
  Red Hat Enterprise Linux 8                            unspecified  0:3.6.16-8.el8_9.1
  Red Hat Enterprise Linux 8.6 Extended Update Support  unspecified  0:3.6.16-5.el8_6.3
  Red Hat Enterprise Linux 8.8 Extended Update Support  unspecified  0:3.6.16-7.el8_8.2
  Red Hat Enterprise Linux 9                            unspecified  0:3.7.6-23.el9_3.3
  Red Hat Enterprise Linux 9                            unspecified  0:3.7.6-23.el9_3.3
  Red Hat Enterprise Linux 9.2 Extended Update Support  unspecified  0:3.7.6-21.el9_2.2
  RHODF-4.15-RHEL-9                                     unspecified  v4.15.0-37
  RHODF-4.15-RHEL-9                                     unspecified  v4.15.0-68
  + 43 more
TIMELINE
  Jan 15  Reserved by redhat
  Jan 16  Published (CNA: redhat)
  Oct 15  EXPLOIT PUBLISHED — CVE-2024-0553 (gnutls). Public exploit reference added.
CWE-203 · CNA: redhat · CVSS v3.1 · 17 references · NVD status: Modified

Description

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
January 15, 2024ReservedReserved by redhat
January 16, 2024PublishedPublished (CNA: redhat)
October 15, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2024-0553 (gnutls). Public exploit reference added.

Affected

Affected products and packages — 53 rows
VendorProduct / PackageEcosystemVersion introducedFixed
—gnutls—3.8.0—
Red HatRed Hat Enterprise Linux 8——0:3.6.16-8.el8_9.1
Red HatRed Hat Enterprise Linux 8——0:3.6.16-8.el8_9.1
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support——0:3.6.16-5.el8_6.3
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support——0:3.6.16-7.el8_8.2
Red HatRed Hat Enterprise Linux 9——0:3.7.6-23.el9_3.3
Red HatRed Hat Enterprise Linux 9——0:3.7.6-23.el9_3.3
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support——0:3.7.6-21.el9_2.2
Red HatRHODF-4.15-RHEL-9——v4.15.0-37
Red HatRHODF-4.15-RHEL-9——v4.15.0-68
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-39
Red HatRHODF-4.15-RHEL-9——v4.15.0-58
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-13
Red HatRHODF-4.15-RHEL-9——v4.15.0-81
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-79
Red HatRHODF-4.15-RHEL-9——v4.15.0-22
Red HatRHODF-4.15-RHEL-9——v4.15.0-57
Red HatRHODF-4.15-RHEL-9——v4.15.0-6
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-15
Red HatRHODF-4.15-RHEL-9——v4.15.0-15
Red HatRHODF-4.15-RHEL-9——v4.15.0-54
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-10
Red HatRHODF-4.15-RHEL-9——v4.15.0-26
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-19
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-158
Red HatRHODF-4.15-RHEL-9——v4.15.0-21
Red HatRHODF-4.15-RHEL-9——v4.15.0-103
Red HatRHOL-5.8-RHEL-9——v5.8.6-22
Red HatRHOL-5.8-RHEL-9——v5.8.6-11
Red HatRHOL-5.8-RHEL-9——v6.8.1-407
Red HatRHOL-5.8-RHEL-9——v5.8.6-19
Red HatRHOL-5.8-RHEL-9——v1.0.0-479
Red HatRHOL-5.8-RHEL-9——v5.8.6-7
Red HatRHOL-5.8-RHEL-9——v0.4.0-247
Red HatRHOL-5.8-RHEL-9——v5.8.6-5
Red HatRHOL-5.8-RHEL-9——v1.1.0-227
Red HatRHOL-5.8-RHEL-9——v5.8.1-470
Red HatRHOL-5.8-RHEL-9——v2.9.6-14
Red HatRHOL-5.8-RHEL-9——v5.8.6-2
Red HatRHOL-5.8-RHEL-9——v5.8.6-24
Red HatRHOL-5.8-RHEL-9——v5.8.6-10
Red HatRHOL-5.8-RHEL-9——v0.1.0-525
Red HatRHOL-5.8-RHEL-9——v0.1.0-224
Red HatRHOL-5.8-RHEL-9——v0.28.1-56
Red HatRed Hat Enterprise Linux 6———
Red HatRed Hat Enterprise Linux 7———

Weaknesses

CWE-203

References (17)

Related

Authoritative record: CVE-2024-0553 at cve.org

Vendors: red hat

Weaknesses: CWE-203

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-0553 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.