Skip to content

openssl CVE-2022-4304

Moderate
bcressey published GHSA-mfpj-xm8w-v6vq Mar 13, 2023

Package

openssl (bottlerocket-test-system)

Affected versions

< 0.0.6

Patched versions

0.0.6

Description

A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext payloads over the network, but this would require a large amount of malicious payloads from a third party actor as trial messages.

Severity

Moderate

CVE ID

CVE-2022-4304

Weaknesses

No CWEs