Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/44398?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44398?format=api", "vulnerability_id": "VCID-1hgm-58xg-r7bt", "summary": "Timing based side channel\nA timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.", "aliases": [ { "alias": "CVE-2022-4304" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/63866?format=api", "purl": "pkg:conan/openssl@1.1.1w", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:conan/openssl@1.1.1w" }, { "url": "http://public2.vulnerablecode.io/api/packages/63867?format=api", "purl": "pkg:conan/openssl@3.0.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-nx5k-32hq-yuh4" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:conan/openssl@3.0.12" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/58751?format=api", "purl": "pkg:conan/openssl@1.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1hgm-58xg-r7bt" }, { "vulnerability": "VCID-3g6n-ujyv-jub3" }, { "vulnerability": "VCID-5a2a-trbk-fkfg" }, { "vulnerability": "VCID-8q7w-7je3-zkgt" }, { "vulnerability": "VCID-as38-bfar-q3hh" }, { "vulnerability": "VCID-erdm-7pfg-e7hc" }, { "vulnerability": "VCID-ju5y-bakm-mqd8" }, { "vulnerability": "VCID-mnkq-e45g-fyfw" }, { "vulnerability": "VCID-nqu1-ffyz-wubt" }, { "vulnerability": "VCID-taas-512g-jfdw" }, { "vulnerability": "VCID-ts7c-u8g2-rqa4" }, { "vulnerability": "VCID-uw52-vah8-uqda" }, { "vulnerability": "VCID-w1qj-n768-hbar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:conan/openssl@1.0.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/58752?format=api", "purl": "pkg:conan/openssl@1.1.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1hgm-58xg-r7bt" }, { "vulnerability": "VCID-3g6n-ujyv-jub3" }, { "vulnerability": "VCID-8q7w-7je3-zkgt" }, { "vulnerability": "VCID-as38-bfar-q3hh" }, { "vulnerability": "VCID-erdm-7pfg-e7hc" }, { "vulnerability": "VCID-gj2m-z5b6-6yf2" }, { "vulnerability": "VCID-ju5y-bakm-mqd8" }, { "vulnerability": "VCID-mm8w-472m-puea" }, { "vulnerability": "VCID-mnkq-e45g-fyfw" }, { "vulnerability": "VCID-n1r2-zqmn-2ufh" }, { "vulnerability": "VCID-taas-512g-jfdw" }, { "vulnerability": "VCID-ts7c-u8g2-rqa4" }, { "vulnerability": "VCID-uw52-vah8-uqda" }, { "vulnerability": "VCID-w1qj-n768-hbar" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:conan/openssl@1.1.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/59827?format=api", "purl": "pkg:conan/openssl@3.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1hgm-58xg-r7bt" }, { "vulnerability": "VCID-1yjs-f4gq-h7ht" }, { "vulnerability": "VCID-3g6n-ujyv-jub3" }, { "vulnerability": "VCID-5a2a-trbk-fkfg" }, { "vulnerability": "VCID-5rhg-tvzd-h7es" }, { "vulnerability": "VCID-86j5-ag2t-2qhj" }, { "vulnerability": "VCID-8q7w-7je3-zkgt" }, { "vulnerability": "VCID-97cm-wmq1-gkfd" }, { "vulnerability": "VCID-as38-bfar-q3hh" }, { "vulnerability": "VCID-erdm-7pfg-e7hc" }, { "vulnerability": "VCID-f2np-fk61-nbh1" }, { "vulnerability": "VCID-gj2m-z5b6-6yf2" }, { "vulnerability": "VCID-ju5y-bakm-mqd8" }, { "vulnerability": "VCID-m7sy-6spe-6yau" }, { "vulnerability": "VCID-mm8w-472m-puea" }, { "vulnerability": "VCID-mnkq-e45g-fyfw" }, { "vulnerability": "VCID-nqu1-ffyz-wubt" }, { "vulnerability": "VCID-nx5k-32hq-yuh4" }, { "vulnerability": "VCID-s6rb-rb8j-yfc6" }, { "vulnerability": "VCID-sd2f-6nk6-dua6" }, { "vulnerability": "VCID-se2f-3x6g-7uc6" }, { "vulnerability": "VCID-taas-512g-jfdw" }, { "vulnerability": "VCID-tjhj-1wc7-rych" }, { "vulnerability": "VCID-ts7c-u8g2-rqa4" }, { "vulnerability": "VCID-vyxk-cz2r-ffgf" }, { "vulnerability": "VCID-w1qj-n768-hbar" }, { "vulnerability": "VCID-yhn2-ctzh-ducy" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:conan/openssl@3.0.0" } ], "references": [ { "reference_url": "https://www.openssl.org/news/secadv/20230207.txt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.openssl.org/news/secadv/20230207.txt" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4304", "reference_id": "CVE-2022-4304", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4304" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 203, "name": "Observable Discrepancy", "description": "The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": null, "exploitability": null, "weighted_severity": null, "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1hgm-58xg-r7bt" }