PT-2023-31051 · Openssl+1 · Openssl+1

Tomato42 · Published 2023-11-22 · Updated 2024-06-15 · CVE-2023-49092

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RustCrypto/RSA (affected versions not specified)

Description The issue is due to a non-constant-time implementation, which leaks information about the private key through timing information observable over the network. An attacker may use this information to recover the key. This vulnerability was discovered as part of the "Marvin Attack", which revealed several RSA implementations, including OpenSSL, had not properly mitigated timing side-channel attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider avoiding the use of the rsa crate in settings where attackers are able to observe timing information, e.g., local use on a non-compromised computer is fine.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-385

Related Identifiers

CVE-2023-49092

GHSA-4GRX-2X9W-596C

GHSA-C38W-74PG-36HR

OPENSUSE-SU-2024:13542-1

RUSTSEC-2023-0071

Affected Products

Debian

Openssl

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49092.json · Exploit
• https://github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hr · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13542-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49092 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-49092 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49092 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2023-0071 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c38w-74pg-36hr · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49092 · Security Note
• https://osv.dev/vulnerability/GHSA-4grx-2x9w-596c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49092 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49092 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49092 · Vendor Advisory
• https://github.com/RustCrypto/RSA/issues/626 · Note
• https://github.com/RustCrypto/RSA · Note