CVE-2022-4304

Timing Oracle in RSA Decryption

MEDIUM

5.9

CVSS Score

Published: February 8, 2023 at 07:04 PM UTC

Updated: October 14, 2026 at 03:16 PM UTC

4 products affected across 2 vendorsOpenSSLNetwork SecurityEndpoint Security

Using OpenSSL by OpenSSL?

Get instant alerts when new vulnerabilities affect OpenSSL - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.9

Exploit prediction

EPSS 24%

SSVC

No known exploit

Description

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

OpenSSL · OpenSSL

95%

All versions1.0.2 ≤ v < 1.0.2zg1.1.1 ≤ v < 1.1.1t3.0.0 ≤ v < 3.0.81.0.2 1.1.1 3.0.0

Affected range stops below 1.0.2zg, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.1.1t, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.0.8, so it looks safe — our inference, not a vendor statement

Endpoint Security · Stormshield

95%

All versionsv < 7.2.40

Affected range stops below 7.2.40, so it looks safe — our inference, not a vendor statement

Network Security · Stormshield

95%

2.7.0 ≤ v < 2.7.112.8.0 ≤ v < 3.7.343.8.0 ≤ v < 3.11.224.0.0 ≤ v < 4.3.164.4.0 ≤ v < 4.6.3

Affected range stops below 2.7.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.11.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.7.34, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.6.3, so it looks safe — our inference, not a vendor statement

Sslvpn · Stormshield

95%

All versionsv < 3.2.1

Affected range stops below 3.2.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.openssl.org/news/secadv/20230207.txt

References (15)

Source: [email protected]

https://security.gentoo.org/glsa/202402-08

Vendor Advisory

Source: [email protected]

https://www.openssl.org/news/secadv/20230207.txt

Source: af854a3a-2127-422b-91ae-364da2661108

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003