CVE-2018-12433

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-12433
cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. NOTE: the vendor does not include side-channel attacks within its threat model

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 4.0

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ Exploit Technical Description Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cryptlib:cryptlib:*:*:*:*:*:*:*:*
History

07 Nov 2023, 02:52

Type Values Removed Values Added
Summary ** DISPUTED ** cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. NOTE: the vendor does not include side-channel attacks within its threat model. cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. NOTE: the vendor does not include side-channel attacks within its threat model

09 Mar 2021, 15:10

Type Values Removed Values Added
CPE cpe:2.3:a:mozilla:network_security_services:-:*:*:*:*:*:*:*
cpe:2.3:a:openbsd:libressl:-:*:*:*:*:*:*:*
cpe:2.3:a:botan_project:botan:-:*:*:*:*:*:*:*
cpe:2.3:a:wolfssl:wolfcrypt:-:*:*:*:*:*:*:*
cpe:2.3:a:matrixssl:matrixssl:-:*:*:*:*:*:*:*
cpe:2.3:a:google:boringssl:-:*:*:*:*:*:*:*
cpe:2.3:a:libtom:libtomcrypt:-:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:-:*:*:*:*:*:*:*
cpe:2.3:a:libsunec_project:libsunec:-:*:*:*:*:*:*:*
cpe:2.3:a:gnupg:libgcrypt:-:*:*:*:*:*:*:*
Information

Published : 2018-06-15 02:29

Updated : 2024-04-11 01:00

NVD link : CVE-2018-12433

Mitre link : CVE-2018-12433

CVE.ORG link : CVE-2018-12433

JSON object : View

Products Affected

cryptlib

  • cryptlib
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-320

Key Management Errors