REDHAT-BUG-2269723: Medium severity rust-openssl vulnerability
Description: A timing based side-channel exists in the rust-openssl package which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve successful decryption an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
References: https://people.redhat.com/~hkario/marvin/ https://github.com/sfackler/rust-openssl/issues/2171
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2269723?
The severity of REDHAT-BUG-2269723 is high due to the potential for a timing-based side-channel attack that could compromise plaintext data.
How do I fix REDHAT-BUG-2269723?
To fix REDHAT-BUG-2269723, you should update the rust-openssl package to the latest version that addresses this vulnerability.
What systems are affected by REDHAT-BUG-2269723?
The rust-openssl package is the primary affected software in relation to REDHAT-BUG-2269723.
What type of attack does REDHAT-BUG-2269723 allow?
REDHAT-BUG-2269723 allows an attacker to potentially perform a Bleichenbacher style attack to recover plaintext.
What is the nature of the vulnerability in REDHAT-BUG-2269723?
The nature of the vulnerability in REDHAT-BUG-2269723 is a timing-based side-channel that could enable decryption from multiple trial messages.