CVE-2022-38493

Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption

published August 20, 2022

CVSS
—
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Published
2022-08-20T19:41Z
EPSS history
Timeline
  • 20 AUG 19:41Z
    Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption
    cvelistv5