CVE-2018-0737
Public on 2018-04-16
Modified on 2018-04-26
Description
OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.
Severity
Low
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | openssl | 2018-04-19 | ALAS-2018-1000 | Fixed |
| Amazon Linux 2 - Core | openssl | 2018-04-26 | ALAS2-2018-1004 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 3.3 | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVD | CVSSv2 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
| NVD | CVSSv3 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |