A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opencryptoki-icatokUpgrade opencryptoki-tpmtokUpgrade opencryptoki-swtokUpgrade opencryptoki-ccatokUpgrade opencryptoki-ep11tokUpgrade opencryptoki-develUpgrade opencryptoki-libsUpgrade opencryptoki-icsftokUpgrade opencryptoki | Mar 12, 2024 | Jan 31, 2024 |
| Debian | — | Upgrade opencryptoki | May 15, 2025 | Jan 31, 2024 |
| Ibm Aix | — | Apply the fix or workaround for opencryptoki_advisory | Jun 4, 2024 | Jan 31, 2024 |
| Oracle_linux | — | Upgrade opencryptoki-develUpgrade opencryptoki-icsftokUpgrade opencryptoki-tpmtokUpgrade opencryptoki-libsUpgrade opencryptoki-swtokUpgrade opencryptoki | Mar 8, 2024 | Jan 25, 2024 |
| Redhat_linux | — | Upgrade opencryptoki-ccatokUpgrade opencryptoki-debuginfoUpgrade opencryptoki-ep11tokUpgrade opencryptoki-tpmtokUpgrade opencryptoki-debugsourceUpgrade opencryptoki-tpmtok-debuginfoUpgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-icsftokUpgrade opencryptoki-ep11tok-debuginfoNo solution existsUpgrade opencryptoki-swtokUpgrade opencryptoki-icatokUpgrade opencryptoki-libs-debuginfoUpgrade opencryptoki-develUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptokiUpgrade opencryptoki-icatok-debuginfoUpgrade opencryptoki-libsUpgrade opencryptoki-ccatok-debuginfo | Mar 11, 2024 | Jan 31, 2024 |
| Rocky_linux | — | Upgrade opencryptokiUpgrade opencryptoki-develUpgrade opencryptoki-swtokUpgrade opencryptoki-tpmtokUpgrade opencryptoki-tpmtok-debuginfoUpgrade opencryptoki-debugsourceUpgrade opencryptoki-icsftokUpgrade opencryptoki-debuginfoUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-libsUpgrade opencryptoki-libs-debuginfo | Apr 8, 2024 | Jan 31, 2024 |
| Suse | — | Upgrade openCryptoki-32bitUpgrade openCryptokiUpgrade openCryptoki-64bitUpgrade openCryptoki-devel | Apr 29, 2024 | Jan 31, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub