GHSA-944j-8ch6-rf6x

ghsaUSosv

m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657

view advisory published 2024-02-05Licence: CC-BY-4.0

A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-50781US	high7.5OT elevated	1.12% (66th)	—	2024-02-05
A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confident…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/CVE-2023-50781WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2254426WEB
https://gitlab.com/m2crypto/m2cryptoPACKAGE
https://gitlab.com/m2crypto/m2crypto/-/issues/342WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-50781ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan