CVE-2022-48570: High severity crypto++ vulnerability
Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-48570?
CVE-2022-48570 is a vulnerability in the Crypto++ library through version 8.4 that allows for a timing side channel attack in ECDSA signature generation.
How does CVE-2022-48570 affect Crypto++?
CVE-2022-48570 affects Crypto++ versions up to and including 8.4.0.
What is the severity of CVE-2022-48570?
CVE-2022-48570 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2022-48570?
To fix CVE-2022-48570, upgrade to a version of Crypto++ that is beyond 8.4.0 and apply any relevant patches.
Where can I find more information about CVE-2022-48570?
More information about CVE-2022-48570 can be found in the following references: [Reference 1](https://github.com/weidai11/cryptopp/issues/992) and [Reference 2](https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_4_0).