REDHAT-BUG-2260407: Medium severity Opencryptoki opencryptoki vulnerability
Description: A timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts was discovered in the opencryptoki package. This side-channel can be used to perform RSA ciphertext decryption or signing without access to the private key. To achieve a successful decryption the attack would need to send a large amount of specifically crafted messages to a service that uses the vulnerable API.
Fixed in: No fixed-in version yet, but a new release is expected in the next 3 weeks or so. Patches are already merged though.
References: https://github.com/opencryptoki/opencryptoki/issues/731 https://github.com/opencryptoki/opencryptoki/pull/737 https://github.com/opencryptoki/opencryptoki/commit/2ea019ee2b09f15724d808382d53baca03403288 https://github.com/opencryptoki/opencryptoki/commit/7ffc0e135b4d923d686be536aa7bf69405a360a1 https://github.com/opencryptoki/opencryptoki/commit/c26e049bf40d656bc51429bad190b82fbf63f0c7 https://people.redhat.com/~hkario/marvin/
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2260407?
The severity of REDHAT-BUG-2260407 is considered high due to the potential for an attacker to decrypt sensitive information without access to the private key.
How do I fix REDHAT-BUG-2260407?
To fix REDHAT-BUG-2260407, you should update the OpenCryptoki package to the latest version that addresses the timing side-channel vulnerability.
What kind of attack can exploit REDHAT-BUG-2260407?
REDHAT-BUG-2260407 can be exploited through a timing side-channel attack that allows decryption or signing of RSA ciphertexts.
Which software is affected by REDHAT-BUG-2260407?
The affected software for REDHAT-BUG-2260407 is the OpenCryptoki package.
Is there a workaround for REDHAT-BUG-2260407 until a fix is applied?
There are no officially recommended workarounds for REDHAT-BUG-2260407, so applying the update is the best course of action.