CVE-2024-2467 Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)
MediumCVSS 5.9
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcrypt-openssl-rsa-perl(Debian:12) | All versions | No fix listed |
| debian/libcrypt-openssl-rsa-perl(Debian:12) | = 0.33-3 | No fix listed |
| debian/libcrypt-openssl-rsa-perl(Debian:12) | = 0.35-1 | No fix listed |
| debian/libcrypt-openssl-rsa-perl(Debian:12) | = 0.41-1 | No fix listed |
| debian/libcrypt-openssl-rsa-perl(Debian:12) | = 0.41-2 | No fix listed |
| debian/libcrypt-openssl-rsa-perl(Debian:13) | < 0.35-1 | 0.35-1 |
| debian/libcrypt-openssl-rsa-perl(Debian:14) | < 0.35-1 | 0.35-1 |
| ubuntu/libcrypt-openssl-rsa-perl(Ubuntu:22.04) | All versions | No fix listed |
| perl-Crypt-OpenSSL-RSA | All versions | No fix listed |
| redhat rhel els | = 6 | No fix listed |
| redhat rhel els | = 7 | No fix listed |
| redhat enterprise linux | All versions | No fix listed |
| redhat openssl | = pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-6.0 | No fix listed |
| redhat openssl | = pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-7.0 | No fix listed |
| redhat openssl | = pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-8.0 | No fix listed |
| redhat openssl | = pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-9.0 | No fix listed |
| ubuntu/libcrypt-openssl-rsa-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcrypt-openssl-rsa-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcrypt-openssl-rsa-perl(Ubuntu:26.10) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2024-2467 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- access.redhat.com vdb-entry
- RHBZ#2269567 issue-tracking
- github.com
- people.redhat.com
- bugs.debian.org issue-tracking