CVE-2023-6258: Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths
Vulnerability summary
CVE-2023-6258 is a high (CVSS 8.1) vulnerability in latchset pkcs11-provider. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.9% of scored vulnerabilities.
Severe, CVSS 8.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 30-01-2024PublishedVulnerability first disclosed.
- 17-06-2025Last modifiedVulnerability information updated.
Description
A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack on PKCS#1 1.5 decryption.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.56% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1300Improper Protection of Physical Side ChannelsThe device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- pkcs11-provider< 0.3-1
Latchset1 product
Ubuntu1 product
- pkcs11-provider< 0.3-1
3 vendors · 3 products
References
6 links- bugzilla.redhat.com/show_bug.cgi?id=2251062Issue TrackingX Refsource REDHATREPORTThird Party Advisory
