Moderate: opencryptoki security update
Summary
ALSA-2024:1239: Moderate: opencryptoki security update. Affects opencryptoki versions < 3.21.0-9.el9_3.alma.1. Fixed in 3.21.0-9.el9_3.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages include support for various cryptographic hardware devices and also provide a software token implementation that can be used without any cryptographic hardware. The packages contain the Slot Daemon (pkcsslotd) and general utilities.
Vulnerability Detail
A timing side-channel vulnerability has been discovered in the handling of RSA PKCS#1 v1.5 padded ciphertexts in opencryptoki. This vulnerability, known as Marvin (CVE-2024-0914), could potentially be exploited by an attacker to extract sensitive information through timing analysis. The impact of this vulnerability can vary depending on the specific use case and deployment environment.
How To Fix
Minimum fixed version
3.21.0-9.el9_3.alma.1
This is the first release that contains the fix.
sudo dnf update opencryptokiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the security update as soon as possible.
Conclusion
In conclusion, opencryptoki is affected by a timing side-channel vulnerability that could potentially be exploited to extract sensitive information. It is recommended to update the opencryptoki packages to version 3.21.0-9.el9_3.alma.1 or later to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencryptoki →
FAQ
Opencryptoki is a set of packages that provide an implementation of the PKCS#11 API for IBM Cryptocards and other cryptographic hardware devices. It also includes a software token implementation for environments without cryptographic hardware.
All versions of opencryptoki prior to 3.21.0-9.el9_3.alma.1 are affected by this vulnerability.
The impact of this vulnerability can vary depending on the specific use case and deployment environment. In some scenarios, an attacker may be able to extract sensitive information through timing analysis.
There is no known exploit for this vulnerability at the time of this advisory.
The security update can be obtained from the official AlmaLinux repositories or through the package management system of the operating system.
Related vulnerabilities
Recent vulnerabilities recorded for opencryptoki.
