CVE-2024-0914

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-0914
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0914.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-0914
Downstream
ALSA (2)
AZL (2)
CLSA (1)
DEBIAN (1)
MGASA (1)
OESA (2)
openSUSE (1)
RHSA (5)
RLSA (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (2)
openSUSE (1)
SUSE (2)
Published
2024-01-31T04:53:28Z
Modified
2026-11-07T02:30:28Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)
Details

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-203"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0914.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "0:3.21.0-10.el8_9"
                        },
                        {
                            "fixed": "0:3.17.0-6.el8_6"
                        },
                        {
                            "fixed": "0:3.19.0-3.el8_8"
                        },
                        {
                            "fixed": "0:3.21.0-9.el9_3"
                        },
                        {
                            "fixed": "0:3.19.0-3.el9_2"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/opencryptoki/opencryptoki

Affected ranges

Type
GIT
Repo
https://github.com/opencryptoki/opencryptoki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
32ab06ccecc9961fa8b6c73ba5e268df379375d4
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.23.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "cpe": "cpe:2.3:a:opencryptoki_project:opencryptoki:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.23.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v2.*
v2.3.2
v2.3.3
v2.4.3
v2.4.3.1
v3.*
v3.0
v3.1
v3.10.0
v3.11.0
v3.11.1
v3.12.0
v3.12.1
v3.13.0
v3.14.0
v3.15.0
v3.15.1
v3.16.0
v3.17.0
v3.18.0
v3.19.0
v3.2
v3.20.0
v3.21.0
v3.22.0
v3.3
v3.4
v3.4.1
v3.5
v3.6
v3.6.1
v3.6.2
v3.7.0
v3.8.0
v3.8.1
v3.8.2
v3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0914.json"