CVE-2023-49092: rustcrypto rsa Covert Timing Channel
Vulnerability summary
CVE-2023-49092 is a medium (CVSS 5.9) Covert Timing Channel vulnerability in rustcrypto rsa. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 28-11-2023PublishedVulnerability first disclosed.
- 27-11-2024Last modifiedVulnerability information updated.
Description
RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · Crates.ioEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.61% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-385Covert Timing ChannelCovert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Chainguard5 products
- atuin< 18.10.0-r0
- deno< 2.6.4-r1
- sccache< 0.12.0-r1
- vector< 0.55.0-r0
- zed< 0.166.1-r0
Wolfi5 products
- atuin< 18.10.0-r0
- deno< 2.6.4-r1
- sccache< 0.12.0-r1
- vector< 0.55.0-r0
- zed< 0.166.1-r0
Crates.Io1 product
- rsa≤ 0.9.6 | ≥ 0.0.0-0 (No fix recorded)
Debian1 product
- rust-rsaAll versions (No fix recorded)
Opensuse1 product
- cargo-audit-advisory-db&distro=openSUSE Tumbleweed< 20231219-1.1
Rustcrypto1 product
- rsa≤ 0.9.5
Ubuntu1 product
- rust-rsaAll versions (No fix recorded)
7 vendors · 15 products
References
16 links- github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hrX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
Show all 16 references
- github.com/RustCrypto/RSAPACKAGE
- crates.io/crates/rsaPACKAGE