---
id: CVE-2024-0914
title: >-
  Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded
  ciphertexts (marvin)
summary: >-
  A timing side-channel vulnerability has been discovered in the opencryptoki
  package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could
  potentially enable unauthorized RSA ciphertext decryption or signing, even
  without a…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-203
vendor: Red Hat
product: opencryptoki
affected:
  - opencryptoki >= 3.0.0 < 3.23.0
  - opencryptoki (all versions)
  - opencryptoki (all versions)
  - opencryptoki (all versions)
  - opencryptoki (all versions)
  - opencryptoki (all versions)
  - opencryptoki
  - opencryptoki
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-08-23T18:54:25.749075Z'
published: '2024-01-31'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T11:39:54.980Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-0914'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:1239'
    label: 'RHSA-2024:1239'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1411'
    label: 'RHSA-2024:1411'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1608'
    label: 'RHSA-2024:1608'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1856'
    label: 'RHSA-2024:1856'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1992'
    label: 'RHSA-2024:1992'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-0914'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2260407'
    label: RHBZ#2260407
  - url: 'https://people.redhat.com/~hkario/marvin/'
tags:
  - cve.org
epss: 0.00878
epssPercentile: 0.59166
ingestedAt: '2026-11-05T21:36:00.821Z'
---

## Overview

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

## Affected

- `opencryptoki >= 3.0.0 < 3.23.0`
- `opencryptoki (all versions)`
- `opencryptoki (all versions)`
- `opencryptoki (all versions)`
- `opencryptoki (all versions)`
- `opencryptoki (all versions)`
- `opencryptoki`
- `opencryptoki`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.