CVE-2022-4304

Published Feb 8, 2023

Last updated 9 months ago

CVSS medium 5.9

Overview

Description: A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
Source: openssl-security@openssl.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.9
Impact score: 3.6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-203

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "70985D55-A574-4151-B451-4D500CBFC29A",
            "versionEndExcluding": "1.0.2zg",
            "versionStartIncluding": "1.0.2"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DE0061D6-8F81-45D3-B254-82A94915FD08",
            "versionEndExcluding": "1.1.1t",
            "versionStartIncluding": "1.1.1"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A6DC5D88-4E99-48F2-8892-610ACA9B5B86",
            "versionEndExcluding": "3.0.8",
            "versionStartIncluding": "3.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:stormshield:endpoint_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "166DF690-041D-4585-A9DA-A6CC72A6A7F3",
            "versionEndExcluding": "7.2.40"
          },
          {
            "criteria": "cpe:2.3:a:stormshield:sslvpn:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DA7E0DD2-D62E-4735-A2C9-47C463BE4AA9",
            "versionEndExcluding": "3.2.1"
          },
          {
            "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "27B77023-4983-4D33-9824-A120A5ED31BD",
            "versionEndExcluding": "2.7.11",
            "versionStartIncluding": "2.7.0"
          },
          {
            "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8BD398C8-BC0B-4ED5-B71A-B9C6D8F63659",
            "versionEndExcluding": "3.7.34",
            "versionStartIncluding": "2.8.0"
          },
          {
            "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "31B59634-B59C-4391-96D3-200A86A6CE3E",
            "versionEndExcluding": "3.11.22",
            "versionStartIncluding": "3.8.0"
          },
          {
            "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F7794B42-8235-4C75-866F-5D0A405F0989",
            "versionEndExcluding": "4.3.16",
            "versionStartIncluding": "4.0.0"
          },
          {
            "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C8A23A5D-928A-4225-9C93-31E5DFE215A7",
            "versionEndExcluding": "4.6.3",
            "versionStartIncluding": "4.4.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References