CVE-2021-43398

 

Published at: - 04-11-2021 10:15

Last modified: - 18-04-2022 08:03

Total changes: - 2

Description

** DISPUTED ** Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks. NOTE: this report is disputed by the vendor and multiple third parties. The execution-time differences are intentional. A user may make a choice of a longer key as a tradeoff between strength and performance. In making this choice, the amount of information leaked to an adversary is of infinitesimal value.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/weidai11/cryptopp/issues/1080
• https://cryptopp.com
• https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222

 

Keywords

NVD

 

CVE-2021-43398

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures