CVE-2018-12433: Infoleak
DISPUTED cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. NOTE: the vendor does not include side-channel attacks within its threat model.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12433?
CVE-2018-12433 is considered a medium severity vulnerability due to potential key exposure through a side-channel attack.
How do I fix CVE-2018-12433?
To mitigate CVE-2018-12433, upgrade to a version of cryptlib later than 3.4.4 that patches this vulnerability.
What is the impact of CVE-2018-12433?
The impact of CVE-2018-12433 includes the possibility of an attacker discovering cryptographic keys through a memory-cache side-channel attack.
Who is affected by CVE-2018-12433?
CVE-2018-12433 affects users of cryptlib versions up to and including 3.4.4.
What types of attacks are possible with CVE-2018-12433?
CVE-2018-12433 allows for a memory-cache side-channel attack against DSA and ECDSA signatures.