PT-2024-5167 · Unknown+3 · Perl-Crypt-Openssl-Rsa+3

Hubert Kario + 1 · Published 2024-03-12 · Updated 2026-02-25 · CVE-2024-2467

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: perl-Crypt-OpenSSL-RSA (affected versions not specified)

Description: A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

AZL-43687

AZL-44739

BDU:2024-05718

CVE-2024-2467

MGASA-2025-0287

OESA-2025-1673

OESA-2025-2001

OPENSUSE-SU-2025:15199-1

SUSE-SU-2025:01884-1

SUSE-SU-2025:01887-1

SUSE-SU-2025_01884-1

SUSE-SU-2025_01887-1

Affected Products

Debian

Red Os

Suse

Perl-Crypt-Openssl-Rsa

References · 34

• https://security-tracker.debian.org/tracker/CVE-2024-2467 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/U5ZZGII2VWUPCN72PQNW3EQIGG3EPVBL · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-2467 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2467 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0287 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:01884-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2467 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2001 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-2467 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1673 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15199-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0287.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:01887-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-2467 · Vendor Advisory