Tomato42

Name of the Vulnerable Software and Affected Versions: perl-Crypt-OpenSSL-RSA (affected versions not specified) Description: A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 8.1.29 PHP versions prior to 8.2.20 PHP versions prior to 8.3.8 **Description** The issue is related to the `openssl private decrypt` function in PHP when using PKCS1 padding, which is the default. This makes PHP vulnerable to the Marvin Attack unless used with an OpenSSL version that includes specific changes. The changes are part of OpenSSL 3.2 and have been backported to stable versions of various Linux distributions and PHP builds for Windows. **Recommendations** For PHP versions prior to 8.1.29, update to version 8.1.29 or later to include OpenSSL patches that fix the vulnerability. For PHP versions prior to 8.2.20, update to version 8.2.20 or later to include OpenSSL patches that fix the vulnerability. For PHP versions prior to 8.3.8, update to version 8.3.8 or later to include OpenSSL patches that fix the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Crypto++ versions through 8.9.0 **Description** The issue is related to a Marvin side channel during decryption with PKCS#1 v1.5 padding. **Recommendations** For versions through 8.9.0, update to a version that contains a fix for this issue to prevent exploitation.

**Name of the Vulnerable Software and Affected Versions** RustCrypto/RSA (affected versions not specified) **Description** The issue is due to a non-constant-time implementation, which leaks information about the private key through timing information observable over the network. An attacker may use this information to recover the key. This vulnerability was discovered as part of the "Marvin Attack", which revealed several RSA implementations, including OpenSSL, had not properly mitigated timing side-channel attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider avoiding the use of the `rsa` crate in settings where attackers are able to observe timing information, e.g., local use on a non-compromised computer is fine.

**Name of the Vulnerable Software and Affected Versions** tlslite-ng versions prior to 0.7.6 and 0.8.0-alpha39 **Description** The code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependent, leaking information about the decrypted ciphertext. This affects all TLS servers that enable RSA key exchange and applications that use the RSA decryption API directly. **Recommendations** For versions prior to 0.7.6, update to version 0.7.6 or later. For versions prior to 0.8.0-alpha39, update to version 0.8.0-alpha39 or later. As a temporary workaround, consider using different TLS implementations to minimize the risk of exploitation, as the patches depend on Python processing individual bytes in a side-channel free manner, which is known not to be the case.

**Name of the Vulnerable Software and Affected Versions** python-rsa (affected versions not specified) **Description** It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** python-ecdsa versions prior to 0.13.3 **Description** A flaw was found in the python-ecdsa library where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. An attacker could use a malleable signature to create false transactions, potentially impacting the confidentiality and integrity of protected information. **Recommendations** For versions prior to 0.13.3, update to version 0.13.3 or later to resolve the issue. As a temporary workaround, consider implementing additional signature verification measures to minimize the risk of exploitation. Restrict the use of the python-ecdsa library until a patch is applied.