CVE-2018-10844

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.

• CWE-385
• CWE-327

• http://www.securityfocus.com/bid/105138Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3050Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3505Broken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10844Issue Tracking, Patch, Third Party Advisory
• https://eprint.iacr.org/2018/747Third Party Advisory
• https://gitlab.com/gnutls/gnutls/merge_requests/657Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/10/msg00022.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/
• https://usn.ubuntu.com/3999-1/Third Party Advisory
• http://www.securityfocus.com/bid/105138Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3050Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3505Broken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10844Issue Tracking, Patch, Third Party Advisory
• https://eprint.iacr.org/2018/747Third Party Advisory
• https://gitlab.com/gnutls/gnutls/merge_requests/657Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/10/msg00022.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/
• https://usn.ubuntu.com/3999-1/Third Party Advisory

Published

Aug 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10839Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation s…6.5
• CVE-2018-1084corosync before version 2.4.4 is vulnerable to an integer ov…7.5
• CVE-2018-10840Linux kernel is vulnerable to a heap-based buffer overflow i…6.6
• CVE-2018-10841glusterfs is vulnerable to privilege escalation on gluster s…8.8
• CVE-2018-10842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-10843source-to-image component of Openshift Container Platform be…8.5
• CVE-2018-10845It was found that the GnuTLS implementation of HMAC-SHA-384 …5.9
• CVE-2018-10846A cache-based side channel in GnuTLS implementation that lea…5.6
• CVE-2018-10847prosody before versions 0.10.2, 0.9.14 is vulnerable to an A…4.2
• CVE-2018-10848Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-10849Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1085openshift-ansible before versions 3.9.23, 3.7.46 deploys a m…9