CVE-2024-28285 Information disclosure in n/a
A fault injection flaw in Crypto++ allows local attackers to disclose sensitive information and escalate privileges via the SymmetricDecrypt function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28285?
CVE-2024-28285 is a critical vulnerability in n/a, published on 13 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
Which versions are affected by CVE-2024-28285?
Linux distribution packages (18)
libcryptopp SUSE:Enterprise Storage 7.1 | All versions | 5.6.5-150000.1.15.1 |
libcryptopp SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 5.6.5-150000.1.15.1 |
libcryptopp SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 5.6.5-150000.1.15.1 |
libcryptopp SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 5.6.5-150000.1.15.1 |
libcryptopp SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Manager Proxy 4.3 | All versions | 8.6.0-150400.3.9.1 |
libcryptopp SUSE:Manager Server 4.3 | All versions | 8.6.0-150400.3.9.1 |
libcryptopp openSUSE:Leap 15.6 | All versions | 8.6.0-150400.3.9.1 |
libcryptopp openSUSE:Tumbleweed | All versions | 8.9.0-4.1 |
How do I fix CVE-2024-28285?
Apply the vendor's patch.
Is CVE-2024-28285 being exploited?
There is no known exploitation of CVE-2024-28285 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-28285, GHSA-w4c4-h4jq-x3xh, SUSE-SU-2025:01816-1, SUSE-SU-2025:01939-1, UBUNTU-CVE-2024-28285, openSUSE-SU-2025:15627-1.