VDB

CVE-2024-23170

CVE-2024-23170 PUBLISHED CVSS 5.5 MEDIUM

An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

EPSS 0.21% · 43.1th percentile

Risk Scores

CVSS v3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.21%
43.1th percentile

Affected Products

VendorProductVersions
armmbed_tls2.0.0, 3.0.0
n/an/an/a

Timeline

  • Jan 31, 2024 CVE Published
  • Feb 8, 2024 EPSS Score
  • Mar 6, 2024 EPSS Score
  • Apr 2, 2024 EPSS Score
  • Apr 30, 2024 EPSS Score
  • May 27, 2024 EPSS Score
  • Jun 23, 2024 EPSS Score
  • Jul 20, 2024 EPSS Score
  • Aug 17, 2024 EPSS Score
  • Sep 13, 2024 EPSS Score
  • Oct 4, 2024 Coalition ESS Score
  • Oct 10, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›