MNBSD-2023-2: Timing Oracle in RSA Decryption

Description

A timing based side channel exists in the OpenSSL RSA Decryption implementation.

Affected Versions

openssl

Specific versions:

• 2.0.0
• 2.0.1
• 2.0.2
• 2.1.0
• 2.1.1
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.1.0
• 3.1.1

Recommendations

No specific recommendations provided.

References

• https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4304
• https://github.com/MidnightBSD/src/commit/fae47427305375221e4e8d49f1027c53e8770430

Additional Information

Aliases: CVE-2022-4304

Published: April 03, 2023
Last Modified: April 03, 2023