CVE-2024-0914

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
redhatCNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
opencryptoki_projectopencryptoki
𝑥
< 3.23.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
opencryptoki
bookworm
no-dsa
bullseye
no-dsa
buster
postponed
sid
3.23.0+dfsg-0.3
fixed
trixie
3.23.0+dfsg-0.3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opencryptoki
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
mantic
ignored
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
ignored
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2024:1239
https://access.redhat.com/errata/RHSA-2024:1411
https://access.redhat.com/errata/RHSA-2024:1608
https://access.redhat.com/errata/RHSA-2024:1856
https://access.redhat.com/errata/RHSA-2024:1992
https://access.redhat.com/security/cve/CVE-2024-0914
https://bugzilla.redhat.com/show_bug.cgi?id=2260407
https://people.redhat.com/~hkario/marvin/
https://access.redhat.com/errata/RHSA-2024:1239
https://access.redhat.com/errata/RHSA-2024:1411
https://access.redhat.com/errata/RHSA-2024:1608
https://access.redhat.com/errata/RHSA-2024:1856
https://access.redhat.com/errata/RHSA-2024:1992
https://access.redhat.com/security/cve/CVE-2024-0914
https://bugzilla.redhat.com/show_bug.cgi?id=2260407
https://people.redhat.com/~hkario/marvin/