CVE-2024-0914
Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)
Severity Score
5.9
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
Se descubrió una vulnerabilidad de canal lateral de temporización en el paquete opencryptoki mientras se procesan textos cifrados acolchados RSA PKCS#1 v1.5. Este fallo podría potencialmente permitir el descifrado o la firma de texto cifrado RSA no autorizado, incluso sin acceso a la clave privada correspondiente.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-01-25 CVE Reserved
- 2024-01-31 CVE Published
- 2024-04-26 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-203: Observable Discrepancy
CAPEC
References (8)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2260407 | 2024-04-23 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2024:1239 | 2024-04-25 | |
| https://access.redhat.com/errata/RHSA-2024:1411 | 2024-04-25 | |
| https://access.redhat.com/errata/RHSA-2024:1608 | 2024-04-25 | |
| https://access.redhat.com/errata/RHSA-2024:1856 | 2024-04-25 | |
| https://access.redhat.com/errata/RHSA-2024:1992 | 2024-04-25 | |
| https://access.redhat.com/security/cve/CVE-2024-0914 | 2024-04-23 | |
| https://people.redhat.com/~hkario/marvin | 2024-04-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Opencryptoki Project Search vendor "Opencryptoki Project" | Opencryptoki Search vendor "Opencryptoki Project" for product "Opencryptoki" | < 3.23.0 Search vendor "Opencryptoki Project" for product "Opencryptoki" and version " < 3.23.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 9.0 Search vendor "Redhat" for product "Enterprise Linux" and version "9.0" | - |
Affected
| ||||||