REDHAT-BUG-1990591: Medium severity Opencryptoki opencryptoki vulnerability
It was discovered that openCryptoki incorrectly handled certain EC keys. An attacker could possibly use this issue to cause a invalid curve attack.
Reference: https://packetstormsecurity.com/files/163741/USN-5031-1.txt
Upstream patch: https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1990591?
The severity of REDHAT-BUG-1990591 is classified as high due to its potential for an invalid curve attack.
How do I fix REDHAT-BUG-1990591?
To fix REDHAT-BUG-1990591, update openCryptoki to the latest patched version that addresses the vulnerability.
What systems are affected by REDHAT-BUG-1990591?
REDHAT-BUG-1990591 affects systems running vulnerable versions of openCryptoki.
What kind of attack can REDHAT-BUG-1990591 facilitate?
REDHAT-BUG-1990591 can facilitate an invalid curve attack which may compromise the cryptographic security of affected systems.
Is there a workaround for REDHAT-BUG-1990591?
Currently, there are no known workarounds for REDHAT-BUG-1990591, so updating is recommended.