PT-2024-25007 · Unknown+1 · Rust-Openssl+1

Robb Gatica · Published 2024-04-04 · Updated 2026-02-25 · CVE-2024-3296

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions rust-openssl (affected versions not specified)

Description A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The issue affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2024-3296

Affected Products

Debian

Rust-Openssl

References · 12

• https://cve.org/CVERecord?id=CVE-2024-3296 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3296 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3296 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-3296 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-3296 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3296 · Vendor Advisory
• https://github.com/sfackler/rust-openssl/issues/2171 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2269723 · Note
• https://t.me/cveNotify/153239 · Telegram Post
• https://t.me/cvenotify/75822 · Telegram Post
• https://t.me/cvenotify/75751 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2024-3296 · Note