Lucene search

Veracode Vulnerability DatabaseVERACODE:45372

HistoryFeb 06, 2024 - 12:16 p.m.

Timing Attack

2024-02-0612:16:59

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cryptography timing rsa encryption vulnerability padding attack tls server sensitive data

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.6%

JSON

Cryptography is vulnerable to a Timing Attack. This vulnerability is due to the predictable structure of padding in ciphertexts during RSA encryption. This flaw enables an attacker to distinguish between different types of padding errors, potentially leading to the decryption of captured messages in TLS servers using RSA key exchanges, thus exposing sensitive data.

CPENameOperatorVersion
cryptographyle41.0.7
cryptographyle41.0.7

CPE	Name	Operator	Version
	cryptography	le	41.0.7
	cryptography	le	41.0.7

References

access.redhat.com/security/cve/CVE-2023-50782

bugzilla.redhat.com/show_bug.cgi?id=2254432

github.com/advisories/GHSA-3ww4-gg4f-jr7f