CVE-2003-0147
No CVSS score yet. EPSS 7.1% chance of exploitation in the next 30 days.
OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).
- EPSS
- 7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openpkg:openpkg
- openssl:openssl
- stunnel:stunnel
References
- ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt
- ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html
- http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625