A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opencryptoki-ep11tokUpgrade opencryptoki-ccatokUpgrade opencryptoki-tpmtokUpgrade opencryptoki-icatokUpgrade opencryptoki-swtokUpgrade opencryptoki-icsftokUpgrade opencryptokiUpgrade opencryptoki-develUpgrade opencryptoki-libs | Mar 12, 2024 | Jan 31, 2024 |
| Debian | — | No solution existsUpgrade opencryptoki | May 15, 2025 | Jan 31, 2024 |
| Ibm Aix | — | Apply the fix or workaround for opencryptoki_advisory | Jun 4, 2024 | Jan 31, 2024 |
| Oracle_linux | — | Upgrade opencryptoki-develUpgrade opencryptoki-tpmtokUpgrade opencryptoki-icsftokUpgrade opencryptoki-libsUpgrade opencryptokiUpgrade opencryptoki-swtok | Mar 8, 2024 | Jan 25, 2024 |
| Redhat_linux | — | Upgrade opencryptoki-tpmtokUpgrade opencryptoki-tpmtok-debuginfoUpgrade opencryptoki-debugsourceUpgrade opencryptoki-debuginfoUpgrade opencryptoki-ep11tok-debuginfoUpgrade opencryptoki-ep11tokUpgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-ccatokNo solution existsUpgrade opencryptoki-icsftokUpgrade opencryptoki-develUpgrade opencryptokiUpgrade opencryptoki-ccatok-debuginfoUpgrade opencryptoki-libsUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptoki-icatokUpgrade opencryptoki-libs-debuginfoUpgrade opencryptoki-icatok-debuginfoUpgrade opencryptoki-swtok | Mar 11, 2024 | Jan 31, 2024 |
| Rocky_linux | — | Upgrade opencryptoki-debuginfoUpgrade opencryptoki-swtok-debuginfoUpgrade opencryptoki-libs-debuginfoUpgrade opencryptoki-debugsourceUpgrade opencryptoki-icsftok-debuginfoUpgrade opencryptoki-libsUpgrade opencryptoki-tpmtok-debuginfoUpgrade opencryptoki-icsftokUpgrade opencryptoki-develUpgrade opencryptoki-swtokUpgrade opencryptoki-tpmtokUpgrade opencryptoki | Apr 8, 2024 | Jan 31, 2024 |
| Suse | — | Upgrade openCryptoki-32bitUpgrade openCryptoki-64bitUpgrade openCryptokiUpgrade openCryptoki-devel | Apr 29, 2024 | Jan 31, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub