CVE-2018-12434
published 2018-06-15CVE-2018-12434: LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem…
PriorityP419medium4.7CVSS 3.0
AVLACHPRLUINSUCHINAN
EPSS
0.32%
24.2th percentile
LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | libressl | < 2.6.5 | 2.6.5 |
| openbsd | libressl | — | — |
| openbsd | libressl | — | — |
| openbsd | libressl | — | — |
| openbsd | libressl | — | — |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.6.5-relnotes.txthttps://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txthttps://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.6.5-relnotes.txthttps://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txthttps://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/
2018-06-15
Published