{"affected":[{"defaultStatus":"affected","ecosystem":"https://github.com/toddr/Crypt-OpenSSL-RSA","packageName":"perl-Crypt-OpenSSL-RSA","product":"","source":"CNA: redhat","vendor":"","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"perl-Crypt-OpenSSL-RSA","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"perl-Crypt-OpenSSL-RSA","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"perl-Crypt-OpenSSL-RSA","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"perl-Crypt-OpenSSL-RSA","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","product":"openssl","source":"ADP: CISA-ADP","vendor":"redhat","versions":[{"status":"affected","version":"pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-6.0"},{"status":"affected","version":"pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-7.0"},{"status":"affected","version":"pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-8.0"},{"status":"affected","version":"pkg:rpm/redhat/perl-crypt-openssl-rsa@distro=redhat-enterprise-linux-9.0"}]}],"cveId":"CVE-2024-2467","cwes":["CWE-208"],"description":"A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.","epss":{"date":"2026-11-04","percentile":0.44078,"score":0.00516},"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793880110718,"publishedAt":1714063502948,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-2467"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269567"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42"},{"source":"CNA: redhat","tags":[],"url":"https://people.redhat.com/~hkario/marvin/"},{"source":"ADP: CVE","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2024-2467"},{"source":"ADP: CVE","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269567"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://github.com/toddr/Crypt-OpenSSL-RSA/issues/42"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://people.redhat.com/~hkario/marvin/"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"This CVE is mitigated (i.e. not exploitable) by using the openssl package with support for implicit rejection shipped in the following RHEL errata:\n\n* https://access.redhat.com/errata/RHSA-2024:0208\n* https://access.redhat.com/errata/RHSA-2024:0154\n* https://access.redhat.com/errata/RHSA-2023:7877\n* https://access.redhat.com/errata/RHSA-2024:0500\n* https://access.redhat.com/errata/RHBA-2023:6627"}],"revision":"79995051ed70492a22a02b90281d551abdb2f23832a4c9eca6a027e03e44aa23","sources":[{"modifiedAt":1793880110718,"name":"CNA: redhat","retrievedAt":1793880774811,"url":"https://www.cve.org/CVERecord?id=CVE-2024-2467"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793880804074,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-2467"}],"ssvc":{"assessedAt":1720901887779,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)","updatedAt":1793880804074}