Mirage Crypto Pk
Monthly
RSA operations in mirage-crypto-pk for OCaml before version 2.3.0 raise an undocumented exception when processing abnormally small messages during encryption or decryption. Any OCaml application - including MirageOS unikernel services - that exposes RSA operations to attacker-influenced inputs without upstream size validation can have those operations disrupted by a remote attacker with low-privilege access. No public exploit has been identified at time of analysis; the CVSS score of 4.3 (A:L only) reflects a limited, availability-focused impact with no confirmed confidentiality or integrity exposure.
RSA operations in mirage-crypto-pk for OCaml before version 2.3.0 raise an undocumented exception when processing abnormally small messages during encryption or decryption. Any OCaml application - including MirageOS unikernel services - that exposes RSA operations to attacker-influenced inputs without upstream size validation can have those operations disrupted by a remote attacker with low-privilege access. No public exploit has been identified at time of analysis; the CVSS score of 4.3 (A:L only) reflects a limited, availability-focused impact with no confirmed confidentiality or integrity exposure.