Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2024-0914

Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

opencryptoki

Default version status: unaffected

  • 3.0.0 to < 3.23.0affected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:3.21.0-10.el8_9 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support

Default version status: affected

  • 0:3.17.0-6.el8_6 to < *unaffected

Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

Default version status: affected

  • 0:3.19.0-3.el8_8 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:3.21.0-9.el9_3 to < *unaffected

Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support

Default version status: affected

  • 0:3.19.0-3.el9_2 to < *unaffected

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: unknown

References