PT-2018-2071 · Openssl+6 · Openssl+6
Published
2018-04-11
·
Updated
2024-06-15
·
CVE-2018-0737
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 1.0.2b through 1.0.2o
OpenSSL versions 1.1.0 through 1.1.0h
Description
The OpenSSL RSA Key generation algorithm is susceptible to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The issue is related to errors in cryptographic transformations.
Recommendations
For OpenSSL versions 1.0.2b through 1.0.2o, update to OpenSSL 1.0.2p-dev or later.
For OpenSSL versions 1.1.0 through 1.1.0h, update to OpenSSL 1.1.0i-dev or later.
Fix
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Ibm Aix
Openssl
Red Hat
Suse
Ubuntu