NVD - CVE-2022-4304 (original) (raw)
CVE-2022-4304 Detail
Current Description
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
Analysis Description
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
Metrics
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:
NIST: NVD
N/A
NVD assessment not yet provided.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
ADP: CISA-ADP
Base Score: 5.9 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 Severity and Vector Strings:
NIST: NVD
Base Score: N/A
NVD assessment not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003 | CVE | |
| https://security.gentoo.org/glsa/202402-08 | CVE, OpenSSL Software Foundation | |
| https://www.openssl.org/news/secadv/20230207.txt | CVE, OpenSSL Software Foundation | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-203 | Observable Discrepancy | NIST CISA-ADP |
Known Affected Software Configurations Switch to CPE 2.2
CPEs loading, please wait.
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
12 change records found show changes
CVE Modified by CISA-ADP 6/17/2026 1:20:32 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | SSVC | {"timestamp":"2025-03-06T15:57:19.589862Z","id":"CVE-2022-4304","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"} |
CVE Modified by OpenSSL Software Foundation 6/17/2026 1:20:32 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Affected | [{"vendor":"OpenSSL","product":"OpenSSL","defaultStatus":"unaffected","versions":[{"version":"3.0.0","lessThan":"3.0.8","versionType":"semver","status":"affected"},{"version":"1.1.1","lessThan":"1.1.1t","versionType":"custom","status":"affected"},{"version":"1.0.2","lessThan":"1.0.2zg","versionType":"custom","status":"affected"}]}] |
CVE Modified by CVE 11/04/2025 3:16:14 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003 |
CVE Modified by CISA-ADP 3/20/2025 5:15:14 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CVSS V3.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | |
| Added | CWE | CWE-203 |
CVE Modified by OpenSSL Software Foundation 2/13/2025 12:15:50 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | Description | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. |
CVE Modified by CVE 11/21/2024 2:34:58 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | https://security.gentoo.org/glsa/202402-08 | |
| Added | Reference | https://www.openssl.org/news/secadv/20230207.txt |
CVE Modified by OpenSSL Software Foundation 5/14/2024 7:53:27 AM
| Action | Type | Old Value | New Value |
|---|
CVE Modified by OpenSSL Software Foundation 2/04/2024 4:15:08 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | Reference | OpenSSL Software Foundation https://security.gentoo.org/glsa/202402-08 [No types assigned] |
CVE Modified by OpenSSL Software Foundation 11/06/2023 10:57:29 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | Description | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. |
CWE Remap by NIST 8/08/2023 10:22:24 AM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Changed | CWE | NVD-CWE-Other | CWE-203 |
Reanalysis by NIST 7/18/2023 8:57:39 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CPE Configuration | OR *cpe:2.3:a:stormshield:endpoint_security:*:*:*:*:*:*:*:* versions up to (excluding) 7.2.40 *cpe:2.3:a:stormshield:sslvpn:*:*:*:*:*:*:*:* versions up to (excluding) 3.2.1 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 2.7.0 up to (excluding) 2.7.11 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 2.8.0 up to (excluding) 3.7.34 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 3.8.0 up to (excluding) 3.11.22 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.3.16 *cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:* versions from (including) 4.4.0 up to (excluding) 4.6.3 |
Initial Analysis by NIST 2/24/2023 12:13:57 PM
| Action | Type | Old Value | New Value |
|---|---|---|---|
| Added | CVSS V3.1 | NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | |
| Added | CWE | NIST NVD-CWE-Other | |
| Added | CPE Configuration | OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (excluding) 1.0.2zg *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1t *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.8 | |
| Changed | Reference Type | https://www.openssl.org/news/secadv/20230207.txt No Types Assigned | https://www.openssl.org/news/secadv/20230207.txt Vendor Advisory |
Quick Info
CVE Dictionary Entry:
CVE-2022-4304
NVD Published Date:
02/08/2023
NVD Last Modified:
06/17/2026
Source:
OpenSSL Software Foundation