A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opencryptoki-tpmtokUpgrade opencryptoki-swtokUpgrade opencryptoki-ccatokUpgrade opencryptoki-ep11tokUpgrade opencryptoki-icatokUpgrade opencryptoki-develUpgrade opencryptoki-libsUpgrade opencryptoki-icsftokUpgrade opencryptoki | Mar 12, 2024 | Jan 31, 2024 |
| Debian | — | Upgrade opencryptoki | May 15, 2025 | Jan 31, 2024 |
| Ibm Aix | — | Apply the fix or workaround for opencryptoki_advisory | Jun 4, 2024 | Jan 31, 2024 |
| Oracle_linux | — | Upgrade opencryptoki-develUpgrade opencryptoki-swtokUpgrade opencryptoki-icsftokUpgrade opencryptoki-libsUpgrade opencryptokiUpgrade opencryptoki-tpmtok | Mar 8, 2024 | Jan 25, 2024 |
| Redhat_linux | — | Upgrade opencryptoki-debugsourceUpgrade opencryptoki-tpmtokUpgrade opencryptoki-debuginfoUpgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-ccatokUpgrade opencryptoki-icsftokUpgrade opencryptoki-ep11tok-debuginfoUpgrade opencryptoki-ep11tokUpgrade opencryptoki-tpmtok-debuginfoNo solution existsUpgrade opencryptoki-libsUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptokiUpgrade opencryptoki-ccatok-debuginfoUpgrade opencryptoki-libs-debuginfoUpgrade opencryptoki-develUpgrade opencryptoki-swtokUpgrade opencryptoki-icatokUpgrade opencryptoki-icatok-debuginfo | Mar 11, 2024 | Jan 31, 2024 |
| Rocky_linux | — | Upgrade opencryptoki-swtokUpgrade opencryptoki-tpmtokUpgrade opencryptokiUpgrade opencryptoki-develUpgrade opencryptoki-icsftokUpgrade opencryptoki-tpmtok-debuginfoUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-debugsourceUpgrade opencryptoki-libsUpgrade opencryptoki-libs-debuginfoUpgrade opencryptoki-debuginfo | Apr 8, 2024 | Jan 31, 2024 |
| Suse | — | Upgrade openCryptoki-develUpgrade openCryptoki-64bitUpgrade openCryptokiUpgrade openCryptoki-32bit | Apr 29, 2024 | Jan 31, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub