ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

🗓️ 30 May 2019 14:48:20Reported by RedHatType

ROHNP cache side-channel can leak ECDSA keys in Libgcrypt before versions 1.7.10 and 1.8.3; blinding during signing helps.

Reporter	Title	Published	Views	Family All 214
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple security vulnerabilities	19 Aug 201920:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance affected by NSS and libgcrypt vulnerabilities (CVE-2018-12404 and CVE-2018-0495)	23 Jan 202015:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affect PowerKVM	17 Dec 201815:00	–	ibm
IBM Security Bulletins	Security Bulletin: Potential side-channel cryptographic vulnerabilities in IBM DataPower Gateway	8 Jun 202121:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple openssl vulnerabilities.	7 Dec 201802:45	–	ibm
FreeBSD	libgcrypt -- side-channel attack vulnerability	13 Jun 201800:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : openssl (ALAS-2018-1102)	9 Nov 201800:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nss (ALAS-2019-1305)	4 Oct 201900:00	–	nessus
Tenable Nessus	Amazon Linux AMI : openssl (ALAS-2018-1102)	7 Dec 201800:00	–	nessus

Vulners

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2018-0495
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-0495
cve	www.cve.org/CVERecord
nccgroup	www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/

28 Jun 2026 12:31Current

6.3Medium risk

Vulners AI Score6.3

CVSS 21.9

CVSS 34.7

EPSS0.00887