CVE-2023-50781CWE-203

CVE-2023-50781

High · published February 6, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
66.0
In the wild
Unconfirmed
What it is

A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01124 · 66.0th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2024-02-06T02:15Z
Affected products (4)
ProductVersionsFixed in
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/update_infrastructureall versions—
m2crypto_project/m2crypto≤ 0.40.1—
References (5)
https://access.redhat.com/security/cve/CVE-2023-50781 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2254426 · [email protected]https://access.redhat.com/security/cve/CVE-2023-50781 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2254426 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-265688.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 05 FEB 20:45Z
    M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657
    cvelistv5