MEDIUM Published January 31, 2024

CVE-2024-0914

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

CVSS base score
5.9 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-203
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

opencryptoki project opencryptoki redhat enterprise linux

References

View full NVD advisory →

Published the same day

Related reading

← Back to CVE watch