CVE-2021-43398 in Crypto++

Riassunto

di MITRE • 05/11/2021

Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Prenotare: 04/11/2021
• Divulgazione: 05/11/2021
• Moderazione: accettato
• Voce: VDB-186084
• CPE: pronto
• CWE: CWE-208 (confermato)
• CVSS: 5.3 (NVD)
• EPSS: 0.01899
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2021-43398
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-43398
• CVE Details: https://www.cvedetails.com/cve/CVE-2021-43398/