The gnutls package, which provides the GNU Transport Layer Security library implementing cryptographic protocols such as SSL, TLS, and DTLS, contains a timing side-channel vulnerability in its deterministic ECDSA implementation. This vulnerability, tracked as CVE-2024-28834 and referred to as the Minerva side-channel information leak, could potentially allow attackers to glean sensitive cryptographic information through timing analysis. Red Hat has issued a security advisory (RHSA-2024:1784) rating the impact as moderate and has released updated packages for Red Hat Enterprise Linux 8 to address this issue.

The vulnerability could allow an attacker to exploit timing side-channel information leaks in deterministic ECDSA operations within the GnuTLS library. This may lead to exposure of sensitive cryptographic material, potentially weakening the security of TLS/SSL communications that rely on GnuTLS. However, there are no known exploits in the wild currently, and the severity is assessed as moderate by Red Hat.

Red Hat has released updated gnutls packages for Red Hat Enterprise Linux 8 that fix this timing side-channel vulnerability. Users should apply the available security update (RHSA-2024:1784) to remediate the issue. Before applying this update, ensure all previously released errata relevant to the system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified or required beyond applying the official update.