What’s Vulnerable › Vulnerabilities

CVE-2023-33855: IBM Common Cryptographic Architecture information disclosure

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-26 · updated 2026-06-17
• Weakness: CWE-385

Description

Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack. IBM X-Force ID: 257676.

Affected products

• IBM Common Cryptographic Architecture: from 7.0.0 before 7.5.37 — fixed in 7.5.37

How to fix

Upgrade to a fixed version: IBM Common Cryptographic Architecture 7.5.37. Check the vendor advisory for mitigations.

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/257676
• https://www.ibm.com/support/pages/node/7145168
• https://exchange.xforce.ibmcloud.com/vulnerabilities/257676
• https://www.ibm.com/support/pages/node/7145168

Get alerted when CVE-2023-33855 or the next vulnerability affects your stack