What’s Vulnerable › Vulnerabilities

CVE-2024-2467: Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-25 · updated 2026-06-17
• Weakness: CWE-208

Description

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.

Affected products

• RedHat Openssl: pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-6.0, pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-7.0, pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-8.0, pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-9.0

References

• https://access.redhat.com/security/cve/CVE-2024-2467
• https://bugzilla.redhat.com/show_bug.cgi?id=2269567
• https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42
• https://people.redhat.com/~hkario/marvin/
• https://access.redhat.com/security/cve/CVE-2024-2467
• https://bugzilla.redhat.com/show_bug.cgi?id=2269567
• https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42
• https://people.redhat.com/~hkario/marvin/

Get alerted when CVE-2024-2467 or the next vulnerability affects your stack