CVE-2022-4304 is a medium-severity vulnerability affecting the OpenSSL RSA Decryption implementation, which is used in various software configurations. This timing-based side-channel vulnerability could potentially allow an attacker to recover plaintext across a network in a Bleichenbacher-style attack. Systems running OpenSSL versions 1.0.2, 1.1.1, and 3.0 are particularly vulnerable and should be updated to the latest versions to mitigate the risk.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if your system is running OpenSSL versions 1.0.2, 1.1.1, or 3.0, as these are particularly vulnerable. This issue is a timing-based side-channel vulnerability in the OpenSSL RSA Decryption implementation, which could potentially allow an attacker to recover plaintext across a network in a Bleichenbacher-style attack. It affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP, and RSASVE.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your OpenSSL to the latest version. For OpenSSL 3.0 users, upgrade to 3.0.8; for 1.1.1 users, upgrade to 1.1.1t; and for 1.0.2 users, upgrade to 1.0.2zg (premium support customers only). This will help mitigate the risk and protect your system.

Is CVE-2022-4304 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-4304 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, a timing-based side channel in the OpenSSL RSA Decryption implementation, affects certain OpenSSL versions. To address this issue, it's important to update your OpenSSL to the latest version, as recommended in the provided advisories.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-203, which is an observable discrepancy in OpenSSL that could allow attackers to recover sensitive information. Updating to the latest OpenSSL version is advised to mitigate this issue.

For more details

CVE-2022-4304 is a medium-severity vulnerability affecting OpenSSL's RSA Decryption implementation. To protect your system, update to the latest OpenSSL version. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• Gentoo security advisory

• OpenSSL security advisory