CVE-2018-12437: LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an…

PriorityP418medium4.9CVSS 3.1

AVPACHPRNUINSCCHINAN

EPSS

0.54%

41.3th percentile

LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
atrodo	net	< 0.14	0.14
debian	libtomcrypt	< libtomcrypt 1.18.2-1 (bookworm)	libtomcrypt 1.18.2-1 (bookworm)
libtom	libtomcrypt	<= 1.18.1	—
libtomcrypt	libtomcrypt	>= 0 < 1.18.2-1	1.18.2-1
libtomcrypt	libtomcrypt	>= 0 < 1.18.2-1	1.18.2-1
libtomcrypt	libtomcrypt	>= 0 < 1.18.2-1	1.18.2-1
libtomcrypt	libtomcrypt	>= 0 < 1.18.2-1	1.18.2-1
silverstripe	graphql	>= 2.0.0 < 2.0.5	2.0.5
silverstripe	graphql	>= 3.1.0 < 3.1.2	3.1.2
trustedfirmware	op-tee	<= 3.5.0	—

CVSS provenance

nvdv3.14.9MEDIUMCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N

osv4.9MEDIUM

vendor_debian4.9LOW

vendor_redhat4.7MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.