Tomato42

Name of the Vulnerable Software and Affected Versions: perl-Crypt-OpenSSL-RSA (affected versions not specified) Description: A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the `openssl private decrypt` function in PHP when using PKCS1 padding, which is the default. This makes PHP vulnerable to the Marvin Attack unless used with an OpenSSL version that includes specific changes. The changes are part of OpenSSL 3.2 and have been backported to stable versions of various Linux distributions and PHP builds for Windows.

The issue is related to a Marvin side channel during decryption with PKCS#1 v1.5 padding.

The issue is due to a non-constant-time implementation, which leaks information about the private key through timing information observable over the network. An attacker may use this information to recover the key. This vulnerability was discovered as part of the "Marvin Attack", which revealed several RSA implementations, including OpenSSL, had not properly mitigated timing side-channel attacks.

The code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependent, leaking information about the decrypted ciphertext. This affects all TLS servers that enable RSA key exchange and applications that use the RSA decryption API directly.

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.

A flaw was found in the python-ecdsa library where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. An attacker could use a malleable signature to create false transactions, potentially impacting the confidentiality and integrity of protected information.