CVE-2023-33855 IBM Common Cryptographic Architecture information disclosure
Remote attackers can exploit timing side-channels in RSA operations to obtain sensitive information from IBM Common Cryptographic Architecture.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33855?
CVE-2023-33855 is a low-severity vulnerability in IBM Common Cryptographic Architecture, published on 26 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Under certain conditions, RSA operations performed by IBM Common Cryptographic Architecture (CCA) 7.0.0 through 7.5.36 may exhibit non-constant-time behavior. This could allow a remote attacker to obtain sensitive information using a timing-based attack. IBM X-Force ID: 257676.
Weakness: CWE-385
Which versions are affected by CVE-2023-33855?
It affects 1 product.
Products include Ibm Common Cryptographic Architecture.
How do I fix CVE-2023-33855?
No fix has been published for CVE-2023-33855 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33855 being exploited?
There is no known exploitation of CVE-2023-33855 in the wild and no public exploit code.
Other vulnerabilities in IBM Common Cryptographic Architecture
- CVE-2023-47150 IBM Common Cryptographic Architecture denial of service
- CVE-2024-22340 IBM Common Cryptographic Architecture information disclosure
- CVE-2024-49823 IBM Common Cryptographic Architecture denial of service
- CVE-2022-22423 Denial of service in CCA for MTM 4767
- CVE-2024-41760 IBM Common Cryptographic Architecture information disclosure
Sources
Also known as GHSA-wwrv-f6v4-m66r.