CVE-2024-0914: 
NixOS vulnerability analysis and mitigation

A timing side-channel vulnerability (CVE-2024-0914) was discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. The vulnerability was disclosed on January 31, 2024, affecting opencryptoki versions up to (excluding) 3.23.0 and various Red Hat Enterprise Linux distributions (NVD).

The vulnerability is a timing side-channel in the handling of RSA PKCS#1 v1.5 padded ciphertexts, which can be exploited by measuring the time differences in decryption operations. The vulnerability has a CVSS v3.1 Base Score of 5.9 (Medium) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (Red Hat).

This flaw could potentially enable unauthorized RSA ciphertext decryption or signing operations without access to the corresponding private key. To achieve a successful decryption, an attacker would need to send a large number of specifically crafted messages to a service that uses the vulnerable API (Bugzilla).

Red Hat has released security updates to address this vulnerability through multiple security advisories including RHSA-2024:1239, RHSA-2024:1411, RHSA-2024:1608, RHSA-2024:1856, and RHSA-2024:1992. Users should update their opencryptoki packages to the latest versions available for their specific Red Hat Enterprise Linux distributions (Red Hat).