CVE-2024-0914 Information

Description

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing even without access to the corresponding private key.

Reference

https://access.redhat.com/security/cve/CVE-2024-0914 https://bugzilla.redhat.com/show_bug.cgi?id=2260407 https://people.redhat.com/~hkario/marvin/