{"id":"ALPINE-CVE-2024-13176","details":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.","modified":"2026-02-08T14:17:02.498117Z","published":"2025-01-20T14:15:26.247Z","upstream":["CVE-2024-13176"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2024-13176"}],"affected":[{"package":{"name":"openssl","ecosystem":"Alpine:v3.17","purl":"pkg:apk/alpine/openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r0"}]}],"versions":["1.1.1-r0","1.1.1-r1","1.1.1-r2","1.1.1-r3","1.1.1-r4","1.1.1-r5","1.1.1a-r0","1.1.1a-r1","1.1.1b-r0","1.1.1b-r1","1.1.1c-r0","1.1.1c-r1","1.1.1d-r1","1.1.1d-r2","1.1.1d-r3","1.1.1d-r4","1.1.1d-r5","1.1.1e-r0","1.1.1f-r0","1.1.1g-r0","1.1.1h-r0","1.1.1i-r0","1.1.1j-r0","1.1.1k-r0","1.1.1k-r1","1.1.1l-r0","3.0.0-r0","3.0.0-r1","3.0.0-r2","3.0.0-r3","3.0.0-r4","3.0.1-r0","3.0.1-r1","3.0.10-r0","3.0.11-r0","3.0.12-r0","3.0.12-r1","3.0.12-r2","3.0.12-r3","3.0.12-r4","3.0.12-r5","3.0.13-r0","3.0.13-r1","3.0.14-r0","3.0.15-r0","3.0.15-r1","3.0.2-r0","3.0.3-r0","3.0.5-r0","3.0.5-r1","3.0.5-r2","3.0.5-r3","3.0.6-r0","3.0.7-r0","3.0.7-r2","3.0.8-r0","3.0.8-r1","3.0.8-r2","3.0.8-r3","3.0.8-r4","3.0.9-r0","3.0.9-r1","3.0.9-r2","3.0.9-r3"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-13176.json"}},{"package":{"name":"openssl","ecosystem":"Alpine:v3.18","purl":"pkg:apk/alpine/openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.8-r0"}]}],"versions":["1.1.1-r0","1.1.1-r1","1.1.1-r2","1.1.1-r3","1.1.1-r4","1.1.1-r5","1.1.1a-r0","1.1.1a-r1","1.1.1b-r0","1.1.1b-r1","1.1.1c-r0","1.1.1c-r1","1.1.1d-r1","1.1.1d-r2","1.1.1d-r3","1.1.1d-r4","1.1.1d-r5","1.1.1e-r0","1.1.1f-r0","1.1.1g-r0","1.1.1h-r0","1.1.1i-r0","1.1.1j-r0","1.1.1k-r0","1.1.1k-r1","1.1.1l-r0","3.0.0-r0","3.0.0-r1","3.0.0-r2","3.0.0-r3","3.0.0-r4","3.0.1-r0","3.0.1-r1","3.0.2-r0","3.0.3-r0","3.0.5-r0","3.0.5-r1","3.0.5-r2","3.0.5-r3","3.0.6-r0","3.0.7-r0","3.0.7-r1","3.0.7-r2","3.0.8-r0","3.0.8-r1","3.1.0-r0","3.1.0-r1","3.1.0-r2","3.1.0-r3","3.1.0-r4","3.1.1-r0","3.1.1-r1","3.1.1-r2","3.1.1-r3","3.1.2-r0","3.1.3-r0","3.1.4-r0","3.1.4-r1","3.1.4-r2","3.1.4-r3","3.1.4-r4","3.1.4-r5","3.1.4-r6","3.1.5-r0","3.1.6-r0","3.1.7-r0","3.1.7-r1"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-13176.json"}},{"package":{"name":"openssl","ecosystem":"Alpine:v3.19","purl":"pkg:apk/alpine/openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.8-r0"}]}],"versions":["1.1.1-r0","1.1.1-r1","1.1.1-r2","1.1.1-r3","1.1.1-r4","1.1.1-r5","1.1.1a-r0","1.1.1a-r1","1.1.1b-r0","1.1.1b-r1","1.1.1c-r0","1.1.1c-r1","1.1.1d-r1","1.1.1d-r2","1.1.1d-r3","1.1.1d-r4","1.1.1d-r5","1.1.1e-r0","1.1.1f-r0","1.1.1g-r0","1.1.1h-r0","1.1.1i-r0","1.1.1j-r0","1.1.1k-r0","1.1.1k-r1","1.1.1l-r0","3.0.0-r0","3.0.0-r1","3.0.0-r2","3.0.0-r3","3.0.0-r4","3.0.1-r0","3.0.1-r1","3.0.2-r0","3.0.3-r0","3.0.5-r0","3.0.5-r1","3.0.5-r2","3.0.5-r3","3.0.6-r0","3.0.7-r0","3.0.7-r1","3.0.7-r2","3.0.8-r0","3.0.8-r1","3.1.0-r0","3.1.0-r1","3.1.0-r2","3.1.0-r3","3.1.0-r4","3.1.0-r5","3.1.1-r0","3.1.1-r1","3.1.1-r2","3.1.1-r3","3.1.2-r0","3.1.3-r0","3.1.4-r0","3.1.4-r1","3.1.4-r2","3.1.4-r3","3.1.4-r4","3.1.4-r5","3.1.4-r6","3.1.5-r0","3.1.6-r0","3.1.6-r1","3.1.6-r2","3.1.7-r0","3.1.7-r1"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-13176.json"}},{"package":{"name":"openssl","ecosystem":"Alpine:v3.20","purl":"pkg:apk/alpine/openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-r2"}]}],"versions":["1.1.1-r0","1.1.1-r1","1.1.1-r2","1.1.1-r3","1.1.1-r4","1.1.1-r5","1.1.1a-r0","1.1.1a-r1","1.1.1b-r0","1.1.1b-r1","1.1.1c-r0","1.1.1c-r1","1.1.1d-r1","1.1.1d-r2","1.1.1d-r3","1.1.1d-r4","1.1.1d-r5","1.1.1e-r0","1.1.1f-r0","1.1.1g-r0","1.1.1h-r0","1.1.1i-r0","1.1.1j-r0","1.1.1k-r0","1.1.1k-r1","1.1.1l-r0","3.0.0-r0","3.0.0-r1","3.0.0-r2","3.0.0-r3","3.0.0-r4","3.0.1-r0","3.0.1-r1","3.0.2-r0","3.0.3-r0","3.0.5-r0","3.0.5-r1","3.0.5-r2","3.0.5-r3","3.0.6-r0","3.0.7-r0","3.0.7-r1","3.0.7-r2","3.0.8-r0","3.0.8-r1","3.1.0-r0","3.1.0-r1","3.1.0-r2","3.1.0-r3","3.1.0-r4","3.1.0-r5","3.1.1-r0","3.1.1-r1","3.1.1-r2","3.1.1-r3","3.1.2-r0","3.1.3-r0","3.1.4-r0","3.1.4-r1","3.1.4-r2","3.1.4-r3","3.1.4-r4","3.1.4-r5","3.1.5-r5","3.2.1-r0","3.2.1-r1","3.2.1-r2","3.3.0-r0","3.3.0-r1","3.3.0-r2","3.3.0-r3","3.3.1-r0","3.3.1-r1","3.3.1-r2","3.3.1-r3","3.3.2-r0","3.3.2-r1"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-13176.json"}},{"package":{"name":"openssl","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-r5"}]}],"versions":["1.1.1-r0","1.1.1-r1","1.1.1-r2","1.1.1-r3","1.1.1-r4","1.1.1-r5","1.1.1a-r0","1.1.1a-r1","1.1.1b-r0","1.1.1b-r1","1.1.1c-r0","1.1.1c-r1","1.1.1d-r1","1.1.1d-r2","1.1.1d-r3","1.1.1d-r4","1.1.1d-r5","1.1.1e-r0","1.1.1f-r0","1.1.1g-r0","1.1.1h-r0","1.1.1i-r0","1.1.1j-r0","1.1.1k-r0","1.1.1k-r1","1.1.1l-r0","3.0.0-r0","3.0.0-r1","3.0.0-r2","3.0.0-r3","3.0.0-r4","3.0.1-r0","3.0.1-r1","3.0.2-r0","3.0.3-r0","3.0.5-r0","3.0.5-r1","3.0.5-r2","3.0.5-r3","3.0.6-r0","3.0.7-r0","3.0.7-r1","3.0.7-r2","3.0.8-r0","3.0.8-r1","3.1.0-r0","3.1.0-r1","3.1.0-r2","3.1.0-r3","3.1.0-r4","3.1.0-r5","3.1.1-r0","3.1.1-r1","3.1.1-r2","3.1.1-r3","3.1.2-r0","3.1.3-r0","3.1.4-r0","3.1.4-r1","3.1.4-r2","3.1.4-r3","3.1.4-r4","3.1.4-r5","3.1.5-r5","3.2.1-r0","3.2.1-r1","3.2.1-r2","3.3.0-r0","3.3.0-r1","3.3.0-r2","3.3.0-r3","3.3.1-r0","3.3.1-r1","3.3.1-r2","3.3.1-r3","3.3.2-r0","3.3.2-r1","3.3.2-r2","3.3.2-r3","3.3.2-r4"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-13176.json"}},{"package":{"name":"openssl","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-r5"}]}],"versions":["1.1.1-r0","1.1.1-r1","1.1.1-r2","1.1.1-r3","1.1.1-r4","1.1.1-r5","1.1.1a-r0","1.1.1a-r1","1.1.1b-r0","1.1.1b-r1","1.1.1c-r0","1.1.1c-r1","1.1.1d-r1","1.1.1d-r2","1.1.1d-r3","1.1.1d-r4","1.1.1d-r5","1.1.1e-r0","1.1.1f-r0","1.1.1g-r0","1.1.1h-r0","1.1.1i-r0","1.1.1j-r0","1.1.1k-r0","1.1.1k-r1","1.1.1l-r0","3.0.0-r0","3.0.0-r1","3.0.0-r2","3.0.0-r3","3.0.0-r4","3.0.1-r0","3.0.1-r1","3.0.2-r0","3.0.3-r0","3.0.5-r0","3.0.5-r1","3.0.5-r2","3.0.5-r3","3.0.6-r0","3.0.7-r0","3.0.7-r1","3.0.7-r2","3.0.8-r0","3.0.8-r1","3.1.0-r0","3.1.0-r1","3.1.0-r2","3.1.0-r3","3.1.0-r4","3.1.0-r5","3.1.1-r0","3.1.1-r1","3.1.1-r2","3.1.1-r3","3.1.2-r0","3.1.3-r0","3.1.4-r0","3.1.4-r1","3.1.4-r2","3.1.4-r3","3.1.4-r4","3.1.4-r5","3.1.5-r5","3.2.1-r0","3.2.1-r1","3.2.1-r2","3.3.0-r0","3.3.0-r1","3.3.0-r2","3.3.0-r3","3.3.1-r0","3.3.1-r1","3.3.1-r2","3.3.1-r3","3.3.2-r0","3.3.2-r1","3.3.2-r2","3.3.2-r3","3.3.2-r4"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-13176.json"}},{"package":{"name":"openssl","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-r5"}]}],"versions":["1.1.1-r0","1.1.1-r1","1.1.1-r2","1.1.1-r3","1.1.1-r4","1.1.1-r5","1.1.1a-r0","1.1.1a-r1","1.1.1b-r0","1.1.1b-r1","1.1.1c-r0","1.1.1c-r1","1.1.1d-r1","1.1.1d-r2","1.1.1d-r3","1.1.1d-r4","1.1.1d-r5","1.1.1e-r0","1.1.1f-r0","1.1.1g-r0","1.1.1h-r0","1.1.1i-r0","1.1.1j-r0","1.1.1k-r0","1.1.1k-r1","1.1.1l-r0","3.0.0-r0","3.0.0-r1","3.0.0-r2","3.0.0-r3","3.0.0-r4","3.0.1-r0","3.0.1-r1","3.0.2-r0","3.0.3-r0","3.0.5-r0","3.0.5-r1","3.0.5-r2","3.0.5-r3","3.0.6-r0","3.0.7-r0","3.0.7-r1","3.0.7-r2","3.0.8-r0","3.0.8-r1","3.1.0-r0","3.1.0-r1","3.1.0-r2","3.1.0-r3","3.1.0-r4","3.1.0-r5","3.1.1-r0","3.1.1-r1","3.1.1-r2","3.1.1-r3","3.1.2-r0","3.1.3-r0","3.1.4-r0","3.1.4-r1","3.1.4-r2","3.1.4-r3","3.1.4-r4","3.1.4-r5","3.1.5-r5","3.2.1-r0","3.2.1-r1","3.2.1-r2","3.3.0-r0","3.3.0-r1","3.3.0-r2","3.3.0-r3","3.3.1-r0","3.3.1-r1","3.3.1-r2","3.3.1-r3","3.3.2-r0","3.3.2-r1","3.3.2-r2","3.3.2-r3","3.3.2-r4"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-13176.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}