CVE-2023-50979: Medium severity crypto++ vulnerability
Published Dec 18, 2023
·Updated
Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.
Affected Software
1 affected component
Cryptopp Crypto\+\+<=8.9.0
Event History
Dec 18, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-50979?
CVE-2023-50979 has been classified as a high severity vulnerability due to its exploitation potential through a side channel during cryptographic operations.
2
How does CVE-2023-50979 impact the security of applications using Crypto++?
CVE-2023-50979 allows attackers to exploit side channel vulnerabilities during decryption, potentially exposing sensitive data.
3
How can I fix CVE-2023-50979?
To mitigate CVE-2023-50979, update Crypto++ to a version newer than 8.9.0 where the issue has been addressed.
4
Which versions of Crypto++ are affected by CVE-2023-50979?
CVE-2023-50979 affects Crypto++ versions up to and including 8.9.0.
5
Is there a workaround for CVE-2023-50979 if I cannot upgrade Crypto++?
A recommended workaround for CVE-2023-50979 is to avoid using PKCS#1 v1.5 padding and switch to a more secure padding scheme.