---
id: CVE-2024-2236
title: A timing-based side-channel flaw was found in libgcrypt's RSA implementation
summary: >-
  A timing-based side-channel flaw was found in libgcrypt's RSA implementation.
  This issue may allow a remote attacker to initiate a Bleichenbacher-style
  attack, which can lead to the decryption of RSA ciphertexts.
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-385
vendor: Red Hat
product: Red Hat Enterprise Linux BaseOS EUS (v.9.2)
affected:
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux_appstream_eus_v_9_2
  - enterprise_linux_appstream_eus_v_9_4
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_eus_v_9_2
  - enterprise_linux_baseos_eus_v_9_4
  - enterprise_linux_baseos_v_9
patched:
  - enterprise_linux_appstream_eus_v_9_2
  - enterprise_linux_appstream_eus_v_9_4
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_eus_v_9_2
  - enterprise_linux_baseos_eus_v_9_4
  - enterprise_linux_baseos_v_9
published: '2024-03-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:43.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-2236'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:9404'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:3530'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2025:3534'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-2236'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2245218'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-2236'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2245218'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2268268'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-2236.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2024-2236'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-2236'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.0114
epssPercentile: 0.66452
ingestedAt: '2026-10-13T21:58:14.101Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-03-07T20:07:33.124826Z'
---

## Overview

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2025:3534** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.2), Red Hat Enterprise Linux BaseOS EUS (v.9.2) · released 2025-04-02 · [advisory](https://access.redhat.com/errata/RHSA-2025:3534)
- **RHSA-2025:3530** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4) · released 2025-04-02 · [advisory](https://access.redhat.com/errata/RHSA-2025:3530)
- **RHSA-2024:9404** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2024-11-12 · [advisory](https://access.redhat.com/errata/RHSA-2024:9404)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-2236.json)