CVE-2003-0147

published 2003-03-31

CVE-2003-0147: OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing…

Priority P4 23 medium 5 CVSS 2.0

AV N AC L Au N C P I N A N

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).

Affected

40 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	openssl	< openssl 0.9.7b-1 (bookworm)	openssl 0.9.7b-1 (bookworm)
openpkg	openpkg	—	—
openpkg	openpkg	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	—	—
openssl	openssl	>= 0 < 0.9.7b-1	0.9.7b-1
openssl	openssl	>= 0 < 0.9.7b-1	0.9.7b-1
openssl	openssl	>= 0 < 0.9.7b-1	0.9.7b-1
openssl	openssl	>= 0 < 0.9.7b-1	0.9.7b-1
peersec_networks	matrixssl	<= 1.0	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—
stunnel	stunnel	—	—

CVSS provenance

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

osv 5.0 MEDIUM

vendor_debian 5.0 MEDIUM

vendor_redhat 5.0 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.