PT-2024-17301
CVE-2024-11862
·
تاريخ النشر
2024-11-27
·
تاريخ التحديث
2024-11-27
الوصف من
CVSS 4.0
5.1
متوسطةالمقاييسAV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Devolutions.XTS.NET versions 2024.11.19 and earlier
Description
The issue concerns a non-constant time cryptographic operation, which can be exploited via timing attacks. This allows an attacker to render half of the encryption key obsolete. Successful exploitation downgrades the security guarantees of the XTS mode to those of ECB mode, enabling block swapping and identification of identical blocks. Timing attacks require specific conditions to be exploitable.
Recommendations
For versions 2024.11.19 and earlier, upgrade the package to version 2024.11.26 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Galois Field multiplications in the package until a patch is applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾