CVE-2022-38493 — Use of a Broken or Risky Cryptographic Algorithm in Project Rhonabwy

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm3 documents3 sources

Severity

7.5HIGHNVD

EPSS

0.1%

top 75.54%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Rhonabwy Project Rhonabwy Debian Rhonabwy

Timeline

PublishedAug 20

Description

Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/rhonabwy< rhonabwy 1.1.7-1 (bookworm)

▶NVDrhonabwy_project/rhonabwy0.9.99 — 1.1.6

▶Debianrhonabwy_project/rhonabwy< 1.1.7-1+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

CVE-2022-38493: Rhonabwy 0↗2022-08-20

▶

📋Vendor Advisories

Debian

CVE-2022-38493: rhonabwy - Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key len...↗2022

▶