SB2025062561 - SUSE update for perl-Crypt-OpenSSL-RSA
Published: June 25, 2025
Security Bulletin ID
SB2025062561
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Cryptographic issues (CVE-ID: CVE-2024-2467)
The vulnerability allows an attacker to decrypt sensitive information.
A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA
package, which could be sufficient to recover plaintext across a network
in a Bleichenbacher-style attack. To achieve successful decryption, an
attacker would have to be able to send a large number of trial messages.
The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding
mode.
Remediation
Install update from vendor's website.