RUSTSEC-2023-0071: 
Rust vulnerability analysis and mitigation

The RustCrypto/RSA library, a pure Rust implementation of RSA, was found to contain a timing vulnerability tracked as RUSTSEC-2023-0071 (CVE-2023-49092). The vulnerability stems from a non-constant-time implementation that could potentially leak private key information through timing information observable over the network (Debian Security).

The vulnerability was initially identified in the rsa::internals::encrypt() function, which exhibits variable-time behavior in relation to the message input. Testing revealed that different messages could result in execution time variations of approximately 0.5%, with specific examples showing a difference of 2,533 instructions between different inputs (GitHub Issue).

The vulnerability could allow attackers to recover the private key by observing timing information, particularly in networked environments where such timing differences are measurable (Debian Security).

Currently, there is no fix available for this vulnerability. The recommended workaround is to avoid using the RSA crate in environments where attackers might be able to observe timing information. The library can still be safely used for local operations on non-compromised computers (Debian Security).