CVE-2023-5388

Updated: 2024-01-10 04:32:12.746613

Description:

It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens before any padding operations, it affects all padding modes: PKCS#1 v1.5, OAEP, and RSASVP. Both API level calls and TLS server operation are affected.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x NONE 0
CVSS Version 3.x MEDIUM 6.5

Status

OS name Project name Version Score Severity Status Errata Last updated
AlmaLinux 9.2 ESU nss 3.79.0 6.5 MEDIUM Needs Triage 2024-02-08 08:26:46
CentOS 6 ELS nss 3.44.0 6.5 MEDIUM Ignored 2024-01-10 13:08:42
CentOS 7 ELS nss 3.79.0 6.5 MEDIUM Ignored 2024-01-10 13:08:42
CentOS 8.4 ELS nss 3.67.0-6 6.5 MEDIUM Ignored 2024-01-10 13:08:42
CentOS 8.5 ELS nss 3.67.0-7 6.5 MEDIUM Ignored 2024-01-10 13:08:42
CloudLinux 6 ELS nss 3.44.0 6.5 MEDIUM Ignored 2024-01-10 13:08:42
Oracle Linux 6 ELS nss 3.44.0 6.5 MEDIUM Ignored 2024-01-10 13:08:42
Ubuntu 16.04 ELS nss 3.28.4-0 6.5 MEDIUM Ignored 2024-01-10 13:08:42
Ubuntu 18.04 ELS nss 3.35-2 6.5 MEDIUM Ignored 2024-01-10 13:08:43