GHSA-4grx-2x9w-596c

Dashboard / Vulnerabilities / GHSA-4grx-2x9w-596c

GHSA-4grx-2x9w-596c

Summary: Marvin Attack: potential key recovery through timing sidechannels

Details: The [Marvin Attack] is a timing sidechannel vulnerability which allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed withthe private key. A recent survey of RSA implementations found that the Rust `rsa` crate is one of many implementations vulnerable to this attack. No fixed version is available at this time. [Marvin Attack]: https://people.redhat.com/~hkario/marvin/

References: https://github.com/RustCrypto/RSA/security/advisories/GHSA-c38w-74pg-36hr, https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643, https://github.com/RustCrypto/RSA/issues/626, https://github.com/RustCrypto/RSA, https://rustsec.org/advisories/RUSTSEC-2023-0071.html