CVE-2024-0914Medium· 5.9▾ SunlitA timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.9%
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.
opencryptoki >= 3.0.0 < 3.23.0opencryptoki (all versions)opencryptoki (all versions)opencryptoki (all versions)opencryptoki (all versions)opencryptoki (all versions)opencryptokiopencryptokiRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-6240Medium· 6.5Kernel: marvin vulnerability side-channel leakage in the rsa decryption operation
CVE-2023-5992Medium· 5.6Opensc: side-channel leaks while stripping encryption pkcs#1 padding
CVE-2026-110926Medium· 5.3A flaw was found in OpenSSH
CVE-2026-56098Medium· 4.3A flaw was found in rubygem-katello
CVE-2026-59640High· 7.5In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths
CVE-2023-52323Medium· 5.9pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323)