OpenBao has a Timing Side-Channel in the Userpass Auth Method

Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...

Whispering Agents: an Event-Driven Covert Communication Protocol for the Internet of Agents

The emergence of the Internet of Agents IoA introduces critical challenges for communication privacy in sensitive, high-stakes domains. While standard Agent-to-Agent A2A protocols secure message content, they are not designed to protect the act of communication itself, leaving agents vulnerable t...

Covert Timing Channel

Overview Affected versions of this package are vulnerable to Covert Timing Channel in block cipher padding removal. An attacker can recover plaintext data by exploiting timing discrepancies during decryption when PKCS7 padding mode is used. Remediation Upgrade mbedtls to version 3.6.4 or higher...

CVE-2025-27587: Covert Timing Channel

OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVPDigestSign API, and then using the private key to extract the K value nonce from the signatures. Next, based on the bit size of t...

CVE-2023-41097

An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0...

When Mitigations Backfire: Timing Channel Attacks and Defense for PRAC-Based RowHammer Mitigations

Per Row Activation Counting PRAC has emerged as a robust framework for mitigating RowHammer RH vulnerabilities in modern DRAM systems. However, we uncover a critical vulnerability: a timing channel introduced by the Alert Back-Off ABO protocol and Refresh Management RFM commands. We present...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2025-1532)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact...

Covert Timing Channel

Overview PostQuantum-Feldman-VSS is a Post-Quantum Secure Feldman's Verifiable Secret Sharing VSS in Python Affected versions of this package are vulnerable to Covert Timing Channel through the findsecurepivot and securematrixsolve functions. An attacker can extract secret information used in the...

PT-2025-22575 · Astra Linux +4 · Astra Linux Special Edition +16

Уязвимость библиотеки OpenSSL связана со cкрытым временным каналом. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, восстановить закрытый ключ...

Covert Timing Channel

Overview openssl is a package that wraps the OpenSSL library. Affected versions of this package are vulnerable to Covert Timing Channel through the decryption process. An attacker can decrypt messages or forge signatures by exchanging a large number of messages with the vulnerable service Marvin...

Covert Timing Channel

Overview Affected versions of this package are vulnerable to Covert Timing Channel through the decryption process. An attacker can decrypt messages or forge signatures by exchanging a large number of messages with the vulnerable service Marvin Attack. Workaround This vulnerability can be mitigate...

CVE-2025-0306: Covert Timing Channel

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service...

An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations.

...

Covert Timing Channel

Overview Affected versions of this package are vulnerable to Covert Timing Channel via the Galois Field multiplications process. An attacker can effectively downgrade the security guarantees of the XTS mode to those of ECB mode, enabling block swapping and identification of identical blocks,...

CVE-2023-46809: Covert Timing Channel

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/hkario/marvin/, if PCKS 1 v1.5 padding is allowed when performing RSA descryption using a privat...

PT-2025-3822

Name of the Vulnerable Software and Affected Versions Ruby affected versions not specified Description The Ruby interpreter is susceptible to the Marvin Attack, which leverages a covert timing channel to transmit data. This issue allows a remote attacker to decrypt previously encrypted messages o...

RHEL 7 : jetty (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jetty: Timing channel attack in util/security/Password.java CVE-2017-9735 - jetty: full server path...

RHEL 6 : jetty (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jetty: Timing channel attack in util/security/Password.java CVE-2017-9735 - jetty: error path information...

RHEL 7 : jetty (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jetty: Timing channel attack in util/security/Password.java CVE-2017-9735 - jetty: crafted URIs allow...

CVE-2024-25964

Dell PowerScale OneFS 9.5.0.x through 9.7.0.x contain a covert timing channel vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service...