Fix CVE(s): CVE-2023-5981, CVE-2024-0553
* SECURITY UPDATE: timing side-channel in RSA-PSK ClientKeyExchange - debian/patches/CVE-2023-5981-pre1.patch: use the appropriate level of randomness for each nettle operation and fail through the library state instead of abort(), in lib/nettle/pk.c, lib/fips.h, lib/includes/gnutls/crypto.h. - debian/patches/CVE-2023-5981-pre2.patch: add the side-channel silent gnutls_privkey_decrypt_data2() on top of nettle rsa_sec_decrypt(), in lib/gnutls_privkey.c, lib/nettle/pk.c, lib/pkcs11_privkey.c, configure.ac and related headers, with selftest and test. - debian/patches/CVE-2023-5981.patch: use the new function in the RSA-PSK server without branching on the decryption result, in lib/auth/rsa_psk.c. - debian/libgnutls30.symbols: add gnutls_privkey_decrypt_data2. - debian/control: build-depend on nettle-dev with rsa_sec_decrypt. - CVE-2023-5981 * SECURITY UPDATE: incomplete fix for CVE-2023-5981 - debian/patches/CVE-2024-0553.patch: move the PSK lookup and key setup before the decryption, in lib/auth/rsa_psk.c. - debian/patches/CVE-2026-5260-decrypt_data2.patch: reject a ciphertext that does not match the modulus size and size the PKCS#11 buffer for the plaintext, in lib/auth/rsa_psk.c and lib/pkcs11_privkey.c. - CVE-2024-0553
- Products
- gnutls-bin, gnutls-doc, guile-gnutls, libgnutls-dev, libgnutls-openssl27, libgnutls28-dev, libgnutls30, libgnutlsxx28
- Affected versions
- Not specified
- Fixed versions
- 3.4.10-4ubuntu1.9+tuxcare.els5
- CVEs
- CVE-2023-5981, CVE-2024-0553, CVE-2026-5260
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:39 UTC · Revision 1
Source evidence
* SECURITY UPDATE: timing side-channel in RSA-PSK ClientKeyExchange - debian/patches/CVE-2023-5981-pre1.patch: use the appropriate level of randomness for each nettle operation and fail through the library state instead of abort(), in lib/nettle/pk.c, lib/fips.h, lib/includes/gnutls/crypto.h. - debian/patches/CVE-2023-5981-pre2.patch: add the side-channel silent gnutls_privkey_decrypt_data2() on top of nettle rsa_sec_decrypt(), in lib/gnutls_privkey.c, lib/nettle/pk.c, lib/pkcs11_privkey.c, configure.ac and related headers, with selftest and test. - debian/patches/CVE-2023-5981.patch: use the new function in the RSA-PSK server without branching on the decryption result, in lib/auth/rsa_psk.c. - debian/libgnutls30.symbols: add gnutls_privkey_decrypt_data2. - debian/control: build-depend on nettle-dev with rsa_sec_decrypt. - CVE-2023-5981 * SECURITY UPDATE: incomplete fix for CVE-2023-5981 - debian/patches/CVE-2024-0553.patch: move the PSK lookup and key setup before the decryption, in lib/auth/rsa_psk.c. - debian/patches/CVE-2026-5260-decrypt_data2.patch: reject a ciphertext that does not match the modulus size and size the PKCS#11 buffer for the plaintext, in lib/auth/rsa_psk.c and lib/pkcs11_privkey.c. - CVE-2024-0553
osv:CLSA-2026-1791621767
gnutls-bin
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
gnutls-doc
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
guile-gnutls
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
libgnutls-dev
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
libgnutls-openssl27
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
libgnutls28-dev
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
libgnutls30
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
libgnutlsxx28
Fixed versions: 3.4.10-4ubuntu1.9+tuxcare.els5
Complete source record
{
"id": "9c55a5632c5310cfecf87ce3155322df8488a3d80186a4b33a9ab395838777e1",
"url": "https://osv.dev/vulnerability/CLSA-2026-1791621767",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix CVE(s): CVE-2023-5981, CVE-2024-0553",
"summary": "* SECURITY UPDATE: timing side-channel in RSA-PSK ClientKeyExchange - debian/patches/CVE-2023-5981-pre1.patch: use the appropriate level of randomness for each nettle operation and fail through the library state instead of abort(), in lib/nettle/pk.c, lib/fips.h, lib/includes/gnutls/crypto.h. - debian/patches/CVE-2023-5981-pre2.patch: add the side-channel silent gnutls_privkey_decrypt_data2() on top of nettle rsa_sec_decrypt(), in lib/gnutls_privkey.c, lib/nettle/pk.c, lib/pkcs11_privkey.c, configure.ac and related headers, with selftest and test. - debian/patches/CVE-2023-5981.patch: use the new function in the RSA-PSK server without branching on the decryption result, in lib/auth/rsa_psk.c. - debian/libgnutls30.symbols: add gnutls_privkey_decrypt_data2. - debian/control: build-depend on nettle-dev with rsa_sec_decrypt. - CVE-2023-5981 * SECURITY UPDATE: incomplete fix for CVE-2023-5981 - debian/patches/CVE-2024-0553.patch: move the PSK lookup and key setup before the decryption, in lib/auth/rsa_psk.c. - debian/patches/CVE-2026-5260-decrypt_data2.patch: reject a ciphertext that does not match the modulus size and size the PKCS#11 buffer for the plaintext, in lib/auth/rsa_psk.c and lib/pkcs11_privkey.c. - CVE-2024-0553",
"evidence": "osv:CLSA-2026-1791621767",
"products": [
{
"name": {
"value": "gnutls-bin",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gnutls-doc",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "guile-gnutls",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libgnutls-dev",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libgnutls-openssl27",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libgnutls28-dev",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libgnutls30",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libgnutlsxx28",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10-4ubuntu1.9+tuxcare.els5",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1791621767",
"aliases": [
"CLSA-2026-1791621767"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "gnutls-bin",
"purl": "pkg:deb/tuxcare/gnutls-bin?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "gnutls-doc",
"purl": "pkg:deb/tuxcare/gnutls-doc?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "guile-gnutls",
"purl": "pkg:deb/tuxcare/guile-gnutls?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "libgnutls-dev",
"purl": "pkg:deb/tuxcare/libgnutls-dev?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "libgnutls-openssl27",
"purl": "pkg:deb/tuxcare/libgnutls-openssl27?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "libgnutls28-dev",
"purl": "pkg:deb/tuxcare/libgnutls28-dev?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "libgnutls30",
"purl": "pkg:deb/tuxcare/libgnutls30?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.10-4ubuntu1.9+tuxcare.els5"
}
]
}
],
"package": {
"name": "libgnutlsxx28",
"purl": "pkg:deb/tuxcare/libgnutlsxx28?distro=ubuntu-16.04",
"ecosystem": "TuxCare:Ubuntu:16.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1791621767.json"
}
}
],
"modified": "2026-10-26T09:32:02.230486655Z",
"provider": "osv",
"upstream": [
"CVE-2023-5981",
"CVE-2024-0553",
"CVE-2026-5260"
],
"references": [
"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1791621767.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-5981",
"https://nvd.nist.gov/vuln/detail/CVE-2024-0553"
]
},
"related_cves": [
{
"value": "CVE-2023-5981",
"evidence": "/upstream"
},
{
"value": "CVE-2024-0553",
"evidence": "/upstream"
},
{
"value": "CVE-2026-5260",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449438,
"published_at": "2026-10-10T08:42:59+00:00"
}