{"id":"CVE-2024-3296","details":"A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.","modified":"2025-01-14T12:13:54.595880Z","published":"2024-04-04T14:15:11Z","withdrawn":"2025-04-22T18:50:03.453849Z","references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269723"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2024-3296"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-3296"}],"affected":[{"package":{"name":"rust-openssl","ecosystem":"Debian:11","purl":"pkg:deb/debian/rust-openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.29-1","0.10.36-1","0.10.41-1","0.10.45-1","0.10.57-1","0.10.64-1","0.10.68-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3296.json"}},{"package":{"name":"rust-openssl","ecosystem":"Debian:12","purl":"pkg:deb/debian/rust-openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.45-1","0.10.57-1","0.10.64-1","0.10.68-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3296.json"}},{"package":{"name":"rust-openssl","ecosystem":"Debian:13","purl":"pkg:deb/debian/rust-openssl?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.45-1","0.10.57-1","0.10.64-1","0.10.68-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3296.json"}}],"schema_version":"1.7.3"}