Moderate: opencryptoki security update
Summary
ALSA-2024:1608: Moderate: opencryptoki security update. Affects opencryptoki versions < 3.21.0-10.el8_9.alma.1. Fixed in 3.21.0-10.el8_9.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages include support for various cryptographic hardware devices, as well as a software token implementation that can be used without any cryptographic hardware. The packages contain the Slot Daemon (pkcsslotd) and general utilities.
Vulnerability Detail
A timing side-channel vulnerability exists in the handling of RSA PKCS#1 v1.5 padded ciphertexts in opencryptoki. This vulnerability, known as Marvin (CVE-2024-0914), could allow an attacker to extract sensitive information by measuring the time taken to process certain cryptographic operations. The impact of this vulnerability could vary depending on the specific use case and the sensitivity of the data being processed.
How To Fix
Minimum fixed version
3.21.0-10.el8_9.alma.1
This is the first release that contains the fix.
sudo dnf update opencryptokiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the opencryptoki packages contain a timing side-channel vulnerability that could allow an attacker to extract sensitive information. It is recommended to update to the latest version of opencryptoki to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for opencryptoki →
FAQ
Opencryptoki is a set of packages that provide support for various cryptographic hardware devices and a software token implementation. It includes the PKCS#11 API and utilities for managing cryptographic operations.
All versions of opencryptoki prior to 3.21.0-10.el8_9.alma.1 are affected by this vulnerability.
The impact of this vulnerability could vary depending on the specific use case and the sensitivity of the data being processed. It could potentially allow an attacker to extract sensitive information by measuring the time taken to process certain cryptographic operations.
No, there is no known workaround for this vulnerability. It is recommended to update to the latest version of opencryptoki to mitigate the issue.
You can find more information about this vulnerability, including the CVE identifier, on the CVE page listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for opencryptoki.
