Memory-Cache Vulnerability in LibreSSL by OpenBSD
CVE-2018-12434
4.7MEDIUM
Summary
LibreSSL versions prior to 2.6.5 and 2.7.x prior to 2.7.4 are susceptible to a memory-cache side-channel attack that targets DSA and ECDSA signatures. This vulnerability, referred to as the Return Of the Hidden Number Problem (ROHNP), allows an attacker to potentially extract cryptographic keys by gaining access to either the local machine or a virtual machine hosted on the same physical hardware. Users of affected versions should implement immediate upgrades and take necessary precautions to safeguard their cryptographic operations.
References
CVSS V3.1
Score:
4.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability Reserved
Vulnerability published