A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opencryptokiUpgrade opencryptoki-icsftokUpgrade opencryptoki-libsUpgrade opencryptoki-develUpgrade opencryptoki-ccatokUpgrade opencryptoki-tpmtokUpgrade opencryptoki-swtokUpgrade opencryptoki-icatokUpgrade opencryptoki-ep11tok | Mar 12, 2024 | Jan 31, 2024 |
| Debian | — | No solution existsUpgrade opencryptoki | May 15, 2025 | Jan 31, 2024 |
| Ibm Aix | — | Apply the fix or workaround for opencryptoki_advisory | Jun 4, 2024 | Jan 31, 2024 |
| Oracle_linux | — | Upgrade opencryptoki-develUpgrade opencryptoki-icsftokUpgrade opencryptoki-swtokUpgrade opencryptoki-tpmtokUpgrade opencryptoki-libsUpgrade opencryptoki | Mar 8, 2024 | Jan 25, 2024 |
| Redhat_linux | — | Upgrade opencryptokiUpgrade opencryptoki-libsUpgrade opencryptoki-ccatok-debuginfoUpgrade opencryptoki-icatok-debuginfoUpgrade opencryptoki-icatokUpgrade opencryptoki-develUpgrade opencryptoki-libs-debuginfoUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptoki-swtokUpgrade opencryptoki-ep11tokUpgrade opencryptoki-debugsourceUpgrade opencryptoki-ep11tok-debuginfoUpgrade opencryptoki-ccatokNo solution existsUpgrade opencryptoki-icsftokUpgrade opencryptoki-tpmtok-debuginfoUpgrade opencryptoki-tpmtokUpgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-debuginfo | Mar 11, 2024 | Jan 31, 2024 |
| Rocky_linux | — | Upgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-libs-debuginfoUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptoki-icsftokUpgrade opencryptoki-libsUpgrade opencryptoki-tpmtok-debuginfoUpgrade opencryptoki-debuginfoUpgrade opencryptoki-debugsourceUpgrade opencryptoki-develUpgrade opencryptokiUpgrade opencryptoki-swtokUpgrade opencryptoki-tpmtok | Apr 8, 2024 | Jan 31, 2024 |
| Suse | — | Upgrade openCryptoki-64bitUpgrade openCryptokiUpgrade openCryptoki-32bitUpgrade openCryptoki-devel | Apr 29, 2024 | Jan 31, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub