How to fix CVE-2024-0914?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Is Opencryptoki affected by CVE-2024-0914?

Organizations using A timing side-channel vulnerability should be aware of moderate risk from CVE-2024-0914 rated CVSS 5.9. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.

CVE-2024-0914

MEDIUM

2024-01-31 [email protected]

5.9

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 24, 2026 - 12:22 vuln.today

Patch Released

Mar 24, 2026 - 12:22 nvd

Patch available

CVE Published

Jan 31, 2024 - 05:15 nvd

MEDIUM 5.9

Description

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key.

Analysis

A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.

Technical Context

This vulnerability is classified under CWE-203. A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key. Affected products include: Opencryptoki Project Opencryptoki, Redhat Enterprise Linux.

Affected Products

Opencryptoki Project Opencryptoki, Redhat Enterprise Linux.

Remediation

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.4

CVSS: +30

POC: 0

CVE-2024-0914 vulnerability details – vuln.today

Back

CVE-2024-0914

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2024-0914

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code