CVE-2024-2467

perl-Crypt-OpenSSL-RSA: side-channel attack in PKCS#1 v1.5 padding mode (Marvin Attack)

Loading…

Severity

Moderate

Red Hat Product Security

5.9

CVSS 3.1

Review impact separately from score.

Published · March 12, 2024

Updated · February 26, 2026

Description

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

This CVE is mitigated (i.e. not exploitable) by using the openssl package with support for implicit rejection shipped in the following RHEL errata:

https://access.redhat.com/errata/RHSA-2024:0208
https://access.redhat.com/errata/RHSA-2024:0154
https://access.redhat.com/errata/RHSA-2023:7877
https://access.redhat.com/errata/RHSA-2024:0500
https://access.redhat.com/errata/RHBA-2023:6627

CVSS / CWE

CVSS 3.1 · 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-208 · Observable Timing Discrepancy