Detections
Analytics

Echo: openssl-1.1.1c: security update to 1.1.1c+e1openssl-1.1.1g: security update to 1.1.1g+e1openssl-1.1.1k: security update to 1.1.1k+e1

medium Tenable Self-Hosted Container Security Plugin ID 478431

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient
 to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful
 decryption an attacker would have to be able to send a very large number of trial messages for decryption.
 The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS
 connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An
 attacker that had observed a genuine connection between a client and a server could use this flaw to send
 trial messages to the server and record the time taken to process them. After a sufficiently large number
 of messages the attacker could recover the pre-master secret used for the original connection and thus be
 able to decrypt the application data sent over that connection. (CVE-2022-4304)

Solution

Update the openssl-1.1.1c library and its related packages to version 1.1.1c+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2022-4304

Plugin Details

Severity: Medium

ID: 478431

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2022-4304

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 12/15/2022

Reference Information

CVE: CVE-2022-4304