Bug 2243644 (CVE-2023-5388)
| Summary: | CVE-2023-5388 nss: timing attack against RSA decryption | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abishop, abobrov, bdettelb, caswilli, erack, fjansen, gotiwari, hkataria, jburrell, jhorak, jsamir, kaycoth, kshier, mvyas, rhos-maint, security-response-team, sthirugn, tpopela, vkrizan |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | firefox 115.9, thunderbird 115.9 | Doc Type: | If docs needed, set a value |
| Doc Text: |
It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens before any padding operations, it affects all padding modes: PKCS#1 v1.5, OAEP, and RSASVP. Both API level calls and TLS server operation are affected.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2243660 | ||
| Bug Blocks: | 2238675, 2268120 | ||
|
Description
Dhananjay Arunesh
2023-10-12 11:32:48 UTC
Created nss tracking bugs for this issue: Affects: fedora-all [bug 2243660] This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:0093 https://access.redhat.com/errata/RHSA-2024:0093 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:0107 https://access.redhat.com/errata/RHSA-2024:0107 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:0105 https://access.redhat.com/errata/RHSA-2024:0105 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0106 https://access.redhat.com/errata/RHSA-2024:0106 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:0108 https://access.redhat.com/errata/RHSA-2024:0108 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:1483 https://access.redhat.com/errata/RHSA-2024:1483 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:1485 https://access.redhat.com/errata/RHSA-2024:1485 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:1484 https://access.redhat.com/errata/RHSA-2024:1484 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2024:1491 https://access.redhat.com/errata/RHSA-2024:1491 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2024:1490 https://access.redhat.com/errata/RHSA-2024:1490 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:1488 https://access.redhat.com/errata/RHSA-2024:1488 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2024:1487 https://access.redhat.com/errata/RHSA-2024:1487 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:1489 https://access.redhat.com/errata/RHSA-2024:1489 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2024:1499 https://access.redhat.com/errata/RHSA-2024:1499 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:1493 https://access.redhat.com/errata/RHSA-2024:1493 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2024:1495 https://access.redhat.com/errata/RHSA-2024:1495 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2024:1498 https://access.redhat.com/errata/RHSA-2024:1498 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:1494 https://access.redhat.com/errata/RHSA-2024:1494 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:1492 https://access.redhat.com/errata/RHSA-2024:1492 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2024:1486 https://access.redhat.com/errata/RHSA-2024:1486 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:1496 https://access.redhat.com/errata/RHSA-2024:1496 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:1497 https://access.redhat.com/errata/RHSA-2024:1497 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Red Hat Enterprise Linux 8.2 Telecommunications Update Service Via RHSA-2024:1500 https://access.redhat.com/errata/RHSA-2024:1500 |