m2crypto RSA Key Exchange timing discrepancy

Summaryinfo

A vulnerability categorized as problematic has been discovered in m2crypto. This affects an unknown function of the component RSA Key Exchange Handler. The manipulation results in timing discrepancy. This vulnerability is identified as CVE-2023-50781. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in m2crypto (affected version unknown). Affected is an unknown functionality of the component RSA Key Exchange Handler. The manipulation with an unknown input leads to a timing discrepancy vulnerability. CWE is classifying the issue as CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. CVE summarizes:

A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

The weakness was released 02/06/2024. The advisory is shared for download at access.redhat.com. This vulnerability is traded as CVE-2023-50781 since 12/13/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• m2crypto

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion