Ocrypto
Monthly
RSA PKCS#1 v1.5 decryption in Oberon Microsystems AG's ocrypto library (versions 3.0.0 through 4.0.0) leaks padding validity through measurable timing differences, enabling Bleichenbacher-style padding oracle attacks that allow plaintext recovery. Affected systems must be running one of the vulnerable library versions and the attacker requires local access and the ability to submit multiple crafted decryption requests while capturing precise timing data. Vendor-released patch version 4.0.1 is available; no public exploit has been identified at time of analysis.
RSA PKCS#1 v1.5 decryption in Oberon Microsystems AG's ocrypto library (versions 3.0.0 through 4.0.0) leaks padding validity through measurable timing differences, enabling Bleichenbacher-style padding oracle attacks that allow plaintext recovery. Affected systems must be running one of the vulnerable library versions and the attacker requires local access and the ability to submit multiple crafted decryption requests while capturing precise timing data. Vendor-released patch version 4.0.1 is available; no public exploit has been identified at time of analysis.