A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)     (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)     (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1447-1 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1992 advisory.

  - opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)     (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1856 advisory.

  - opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)     (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1608 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1608 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1608 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1608 advisory.

  - opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)     (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1411 advisory.

  - opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)     (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1239 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1239 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1239 advisory.

  - opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)     (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196487	RHEL 6 : opencryptoki (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196476	RHEL 7 : opencryptoki (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
194460	SUSE SLES15 / openSUSE 15 Security Update : openCryptoki (SUSE-SU-2024:1447-1)	Nessus	SuSE Local Security Checks	medium
193787	RHEL 8 : opencryptoki (RHSA-2024:1992)	Nessus	Red Hat Local Security Checks	medium
193373	RHEL 9 : opencryptoki (RHSA-2024:1856)	Nessus	Red Hat Local Security Checks	medium
192948	Rocky Linux 8 : opencryptoki (RLSA-2024:1608)	Nessus	Rocky Linux Local Security Checks	medium
192914	AlmaLinux 8 : opencryptoki (ALSA-2024:1608)	Nessus	Alma Linux Local Security Checks	medium
192904	Oracle Linux 8 : opencryptoki (ELSA-2024-1608)	Nessus	Oracle Linux Local Security Checks	medium
192853	RHEL 8 : opencryptoki (RHSA-2024:1608)	Nessus	Red Hat Local Security Checks	medium
192288	RHEL 8 : opencryptoki (RHSA-2024:1411)	Nessus	Red Hat Local Security Checks	medium
191788	AlmaLinux 9 : opencryptoki (ALSA-2024:1239)	Nessus	Alma Linux Local Security Checks	medium
191757	Oracle Linux 9 : opencryptoki (ELSA-2024-1239)	Nessus	Oracle Linux Local Security Checks	medium
191740	RHEL 9 : opencryptoki (RHSA-2024:1239)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2024-0914

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium