title: Rust-openssl: timing based side-channel can lead to a bleichenbacher style attack
description: A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
problem types: Observable Discrepancy
affected:
{
product: upstream
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: 389-ds:1.4/389-ds-base
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python3.12-cryptography
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:8
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: 389-ds-base
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: keylime-agent-rust
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: python3.12-cryptography
defaultStatus: unknown
cpes: cpe:/o:redhat:enterprise_linux:9
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: 389-ds-base
defaultStatus: unknown
}
{
product: Extra Packages for Enterprise Linux
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: 389-directory-server:testing/389-ds-base
defaultStatus: unknown
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: bootc
defaultStatus: unknown
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: rust-bootupd
defaultStatus: unknown
}
{
product: Extra Packages for Enterprise Linux
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: 389-directory-server:next/389-ds-base
defaultStatus: unknown
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: rust-openssl
defaultStatus: unknown
}
{
product: Fedora
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: rust-zincati
defaultStatus: unknown
}
{
product: Extra Packages for Enterprise Linux
vendor: Fedora
collectionURL: https://packages.fedoraproject.org/
packageName: 389-directory-server:stable/389-ds-base
defaultStatus: unknown
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]