Skip to content

openssl CVE-2022-4304

Moderate
cbgbt published GHSA-j859-pmrq-9q6c Feb 9, 2023

Package

openssl (bottlerocket-update-operator)

Affected versions

< 1.1.0

Patched versions

1.1.0

Description

A timing based side channel exists in the OpenSSL RSA decryption implementation which could enable a recovery of plaintext from across the network. This affects all RSA padding modes. A server agent compiled with OpenSSL could be made to give up plaintext payloads over the network, but this would require a large amount of malicious payloads from a third party actor as trial messages.

Severity

Moderate

CVE ID

CVE-2022-4304

Weaknesses

No CWEs