CVE-2015-2141 — Sensitive Information Exposure in Libcrypto

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.4%
top 39.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian LibcryptoCryptopp Crypto + + LibraryOpensuse
Timeline
PublishedJul 1
Latest updateMay 14

Description

The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/libcrypto< libcrypto++ 5.6.1-7 (bookworm)
▶NVDopensuse/opensuse13.1, 13.2+1

🔴Vulnerability Details

2
GHSA
GHSA-xm6q-j5wx-7362: The InvertibleRWFunction::CalculateInverse function in rw↗2022-05-14
▶
OSV
CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw↗2015-07-01
▶

📋Vendor Advisories

1
Debian
CVE-2015-2141: libcrypto++ - The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6....↗2015
▶
CVE-2015-2141 — Sensitive Information Exposure | cvebase