{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2003-03-14T00:00:00", "descriptions": [{"lang": "en", "value": "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-19T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-288", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2003/dsa-288"}, {"name": "RHSA-2003:101", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://www.redhat.com/support/errata/RHSA-2003-101.html"}, {"name": "RHSA-2003:102", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://www.redhat.com/support/errata/RHSA-2003-102.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.openssl.org/news/secadv_20030317.txt"}, {"name": "GLSA-200303-15", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://marc.info/?l=bugtraq&m=104829040921835&w=2"}, {"name": "20030325 Fwd: APPLE-SA-2003-03-24 Samba, OpenSSL", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"name": "APPLE-SA-2003-03-24", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"name": "20030317 [ADVISORY] Timing Attack on OpenSSL", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=104792570615648&w=2"}, {"name": "CSSA-2003-014.0", "tags": ["vendor-advisory", "x_refsource_CALDERA"], "url": "ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt"}, {"name": "MDKSA-2003:035", "tags": ["vendor-advisory", "x_refsource_MANDRAKE"], "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035"}, {"tags": ["x_refsource_MISC"], "url": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf"}, {"name": "GLSA-200303-23", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml"}, {"name": "oval:org.mitre.oval:def:466", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466"}, {"name": "OpenPKG-SA-2003.019", "tags": ["vendor-advisory", "x_refsource_OPENPKG"], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html"}, {"name": "GLSA-200303-24", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://marc.info/?l=bugtraq&m=104861762028637&w=2"}, {"name": "IMNX-2003-7+-001-01", "tags": ["vendor-advisory", "x_refsource_IMMUNIX"], "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"name": "20030327 Immunix Secured OS 7+ openssl update", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"name": "20030501-01-I", "tags": ["vendor-advisory", "x_refsource_SGI"], "url": "ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I"}, {"name": "20030313 Vulnerability in OpenSSL", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=104766550528628&w=2"}, {"name": "20030320 [OpenPKG-SA-2003.026] OpenPKG Security Advisory (openssl)", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=104819602408063&w=2"}, {"name": "CLA-2003:625", "tags": ["vendor-advisory", "x_refsource_CONECTIVA"], "url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625"}, {"name": "VU#997481", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/997481"}, {"name": "20030313 OpenSSL Private Key Disclosure", "tags": ["mailing-list", "x_refsource_VULNWATCH"], "url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2003-0147", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-288", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2003/dsa-288"}, {"name": "RHSA-2003:101", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2003-101.html"}, {"name": "RHSA-2003:102", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2003-102.html"}, {"name": "http://www.openssl.org/news/secadv_20030317.txt", "refsource": "CONFIRM", "url": "http://www.openssl.org/news/secadv_20030317.txt"}, {"name": "GLSA-200303-15", "refsource": "GENTOO", "url": "http://marc.info/?l=bugtraq&m=104829040921835&w=2"}, {"name": "20030325 Fwd: APPLE-SA-2003-03-24 Samba, OpenSSL", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"name": "APPLE-SA-2003-03-24", "refsource": "APPLE", "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"name": "20030317 [ADVISORY] Timing Attack on OpenSSL", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=104792570615648&w=2"}, {"name": "CSSA-2003-014.0", "refsource": "CALDERA", "url": "ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt"}, {"name": "MDKSA-2003:035", "refsource": "MANDRAKE", "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035"}, {"name": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf", "refsource": "MISC", "url": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf"}, {"name": "GLSA-200303-23", "refsource": "GENTOO", "url": "http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml"}, {"name": "oval:org.mitre.oval:def:466", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466"}, {"name": "OpenPKG-SA-2003.019", "refsource": "OPENPKG", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html"}, {"name": "GLSA-200303-24", "refsource": "GENTOO", "url": "http://marc.info/?l=bugtraq&m=104861762028637&w=2"}, {"name": "IMNX-2003-7+-001-01", "refsource": "IMMUNIX", "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"name": "20030327 Immunix Secured OS 7+ openssl update", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"name": "20030501-01-I", "refsource": "SGI", "url": "ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I"}, {"name": "20030313 Vulnerability in OpenSSL", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=104766550528628&w=2"}, {"name": "20030320 [OpenPKG-SA-2003.026] OpenPKG Security Advisory (openssl)", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=104819602408063&w=2"}, {"name": "CLA-2003:625", "refsource": "CONECTIVA", "url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625"}, {"name": "VU#997481", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/997481"}, {"name": "20030313 OpenSSL Private Key Disclosure", "refsource": "VULNWATCH", "url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T01:43:35.976Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-288", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2003/dsa-288"}, {"name": "RHSA-2003:101", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://www.redhat.com/support/errata/RHSA-2003-101.html"}, {"name": "RHSA-2003:102", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://www.redhat.com/support/errata/RHSA-2003-102.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.openssl.org/news/secadv_20030317.txt"}, {"name": "GLSA-200303-15", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=104829040921835&w=2"}, {"name": "20030325 Fwd: APPLE-SA-2003-03-24 Samba, OpenSSL", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"name": "APPLE-SA-2003-03-24", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"name": "20030317 [ADVISORY] Timing Attack on OpenSSL", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=104792570615648&w=2"}, {"name": "CSSA-2003-014.0", "tags": ["vendor-advisory", "x_refsource_CALDERA", "x_transferred"], "url": "ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt"}, {"name": "MDKSA-2003:035", "tags": ["vendor-advisory", "x_refsource_MANDRAKE", "x_transferred"], "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf"}, {"name": "GLSA-200303-23", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml"}, {"name": "oval:org.mitre.oval:def:466", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466"}, {"name": "OpenPKG-SA-2003.019", "tags": ["vendor-advisory", "x_refsource_OPENPKG", "x_transferred"], "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html"}, {"name": "GLSA-200303-24", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=104861762028637&w=2"}, {"name": "IMNX-2003-7+-001-01", "tags": ["vendor-advisory", "x_refsource_IMMUNIX", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"name": "20030327 Immunix Secured OS 7+ openssl update", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"name": "20030501-01-I", "tags": ["vendor-advisory", "x_refsource_SGI", "x_transferred"], "url": "ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I"}, {"name": "20030313 Vulnerability in OpenSSL", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=104766550528628&w=2"}, {"name": "20030320 [OpenPKG-SA-2003.026] OpenPKG Security Advisory (openssl)", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=104819602408063&w=2"}, {"name": "CLA-2003:625", "tags": ["vendor-advisory", "x_refsource_CONECTIVA", "x_transferred"], "url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625"}, {"name": "VU#997481", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/997481"}, {"name": "20030313 OpenSSL Private Key Disclosure", "tags": ["mailing-list", "x_refsource_VULNWATCH", "x_transferred"], "url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2003-0147", "datePublished": "2003-03-18T05:00:00", "dateReserved": "2003-03-14T00:00:00", "dateUpdated": "2024-08-08T01:43:35.976Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openpkg:openpkg:*:*:*:*:*:*:*:*", "matchCriteriaId": "F74941A0-97CA-44D4-B55B-9224F051D40F", "vulnerable": true}, {"criteria": "cpe:2.3:a:openpkg:openpkg:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "85CCF640-211C-4EC0-9F41-68F5B39CA3F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:openpkg:openpkg:1.2:*:*:*:*:*:*:*", "matchCriteriaId": "B6ADD463-E918-4F4D-9FA7-D109EBC98BD8", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6:*:*:*:*:*:*:*", "matchCriteriaId": "B5E4742C-A983-4F00-B24F-AB280C0E876D", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6a:*:*:*:*:*:*:*", "matchCriteriaId": "8A0628DF-3A4C-4078-B615-22260671EABF", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6b:*:*:*:*:*:*:*", "matchCriteriaId": "962FCB86-15AD-4399-8B7D-EC1DEA919C59", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:*:*", "matchCriteriaId": "0FCA45CE-4127-47AD-BBA8-8A6DD83AE1C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:*:*", "matchCriteriaId": "7CA1CA40-7DB5-4DCA-97A8-9A8CF4FECECC", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:*:*", "matchCriteriaId": "180D07AE-C571-4DD6-837C-43E2A946007A", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:*:*", "matchCriteriaId": "90789533-C741-4B1C-A24B-2C77B9E4DE5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:*:*", "matchCriteriaId": "1520065B-46D7-48A4-B9D0-5B49F690C5B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:*:*", "matchCriteriaId": "5B76FE2D-FBE0-4A3B-A0EA-179332D74F0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:*", "matchCriteriaId": "45A518E8-21BE-4C5C-B425-410AB1208E9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*", "matchCriteriaId": "78E79A05-64F3-4397-952C-A5BB950C967D", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.7:*:*:*:*:*:*:*", "matchCriteriaId": "185B6AF8-18E7-4E6A-A7B9-60DFB17F33E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.8:*:*:*:*:*:*:*", "matchCriteriaId": "400FE849-D547-44DE-B06F-5B68E5B20E07", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.9:*:*:*:*:*:*:*", "matchCriteriaId": "C236DC35-A2F7-47FB-AD51-17D2A0FD7DA2", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.10:*:*:*:*:*:*:*", "matchCriteriaId": "B256301B-9C6A-4BA6-8318-675C0EF4C316", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.11:*:*:*:*:*:*:*", "matchCriteriaId": "EC33DAEE-8F51-404F-B5C4-B8A30B467E94", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.12:*:*:*:*:*:*:*", "matchCriteriaId": "1FCDC66D-3BF5-4763-8877-38B0D3326E62", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.13:*:*:*:*:*:*:*", "matchCriteriaId": "75772E28-BD93-4981-96FA-CDF41DAF65AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.14:*:*:*:*:*:*:*", "matchCriteriaId": "2415230E-4F66-4DDE-9E34-F685E8F4085A", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.15:*:*:*:*:*:*:*", "matchCriteriaId": "5121749D-3E19-4A9B-8C2D-84420A4E289B", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.16:*:*:*:*:*:*:*", "matchCriteriaId": "6E14DE44-69E6-4D0E-AD06-A829AFCDE528", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.17:*:*:*:*:*:*:*", "matchCriteriaId": "3D5B202D-D93D-4E33-BC9F-DA44B727C0B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.18:*:*:*:*:*:*:*", "matchCriteriaId": "CCC62D42-832D-4E6E-93D9-E7BA0CBC7799", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.19:*:*:*:*:*:*:*", "matchCriteriaId": "B5D49F98-9A24-464A-8695-58218C14B3DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.20:*:*:*:*:*:*:*", "matchCriteriaId": "ADFFE78D-90EC-46C6-B215-2EADD9E0D146", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.21:*:*:*:*:*:*:*", "matchCriteriaId": "6132108C-C344-4ABC-AF40-1925830A6723", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:3.22:*:*:*:*:*:*:*", "matchCriteriaId": "F16BDA03-BFAB-4839-A83A-370865928225", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "6FC396CE-FDA7-480C-9E94-1A26B7FB208E", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:4.01:*:*:*:*:*:*:*", "matchCriteriaId": "C7B30722-13DD-41C5-9CFA-0719B351CF46", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:4.02:*:*:*:*:*:*:*", "matchCriteriaId": "722BA04D-BA9B-427C-B129-06EFEC3F2859", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:4.03:*:*:*:*:*:*:*", "matchCriteriaId": "2891FF7D-E62E-47F4-8873-1E4066247348", "vulnerable": true}, {"criteria": "cpe:2.3:a:stunnel:stunnel:4.04:*:*:*:*:*:*:*", "matchCriteriaId": "6A129110-60C1-46FC-9817-6E3802ADB389", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal)."}], "id": "CVE-2003-0147", "lastModified": "2024-11-20T23:44:05.270", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2003-03-31T05:00:00.000", "references": [{"source": "[email protected]", "url": "ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt"}, {"source": "[email protected]", "url": "ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html"}, {"source": "[email protected]", "url": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf"}, {"source": "[email protected]", "url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=104766550528628&w=2"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=104792570615648&w=2"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=104819602408063&w=2"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=104829040921835&w=2"}, {"source": "[email protected]", "url": "http://marc.info/?l=bugtraq&m=104861762028637&w=2"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2003/dsa-288"}, {"source": "[email protected]", "url": "http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/997481"}, {"source": "[email protected]", "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035"}, {"source": "[email protected]", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html"}, {"source": "[email protected]", "url": "http://www.openssl.org/news/secadv_20030317.txt"}, {"source": "[email protected]", "url": "http://www.redhat.com/support/errata/RHSA-2003-101.html"}, {"source": "[email protected]", "url": "http://www.redhat.com/support/errata/RHSA-2003-102.html"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"source": "[email protected]", "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"source": "[email protected]", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0130.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=104766550528628&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=104792570615648&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=104819602408063&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=104829040921835&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=bugtraq&m=104861762028637&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2003/dsa-288"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.gentoo.org/security/en/glsa/glsa-200303-23.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/997481"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:035"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2003.019.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openssl.org/news/secadv_20030317.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.redhat.com/support/errata/RHSA-2003-101.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.redhat.com/support/errata/RHSA-2003-102.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/316165/30/25370/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/316577/30/25310/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A466"}], "sourceIdentifier": "[email protected]", "vendorComments": [{"comment": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", "lastModified": "2007-03-14T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2003:102", "cpe": "cpe:/o:redhat:enterprise_linux:2.1", "product_name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1", "release_date": "2003-03-31T00:00:00Z"}, {"advisory": "RHSA-2003:102", "cpe": "cpe:/o:redhat:enterprise_linux:2.1", "product_name": "Red Hat Enterprise Linux ES version 2.1", "release_date": "2003-03-31T00:00:00Z"}, {"advisory": "RHSA-2003:102", "cpe": "cpe:/o:redhat:enterprise_linux:2.1", "product_name": "Red Hat Enterprise Linux WS version 2.1", "release_date": "2003-03-31T00:00:00Z"}, {"advisory": "RHSA-2003:101", "cpe": "cpe:/o:redhat:linux:6.2", "product_name": "Red Hat Linux 6.2", "release_date": "2003-04-01T00:00:00Z"}, {"advisory": "RHSA-2003:101", "cpe": "cpe:/o:redhat:linux:7.0", "product_name": "Red Hat Linux 7.0", "release_date": "2003-04-01T00:00:00Z"}, {"advisory": "RHSA-2003:101", "cpe": "cpe:/o:redhat:linux:7.1", "product_name": "Red Hat Linux 7.1", "release_date": "2003-04-01T00:00:00Z"}, {"advisory": "RHSA-2003:205", "cpe": "cpe:/o:redhat:linux:7.1", "product_name": "Red Hat Linux 7.1", "release_date": "2003-06-23T00:00:00Z"}, {"advisory": "RHSA-2003:101", "cpe": "cpe:/o:redhat:linux:7.2", "product_name": "Red Hat Linux 7.2", "release_date": "2003-04-01T00:00:00Z"}, {"advisory": "RHSA-2003:101", "cpe": "cpe:/o:redhat:linux:7.3", "product_name": "Red Hat Linux 7.3", "release_date": "2003-04-01T00:00:00Z"}, {"advisory": "RHSA-2003:101", "cpe": "cpe:/o:redhat:linux:8.0", "product_name": "Red Hat Linux 8.0", "release_date": "2003-04-01T00:00:00Z"}, {"advisory": "RHSA-2003:101", "cpe": "cpe:/o:redhat:linux:9", "product_name": "Red Hat Linux 9", "release_date": "2003-04-01T00:00:00Z"}, {"advisory": "RHSA-2003:102", "cpe": "cpe:/o:redhat:enterprise_linux:2.1", "product_name": "Red Hat Linux Advanced Workstation 2.1", "release_date": "2003-03-31T00:00:00Z"}, {"advisory": "RHSA-2003:117", "cpe": "cpe:/a:redhat:stronghold:3", "product_name": "Red Hat Stronghold 3", "release_date": "2003-04-15T00:00:00Z"}, {"advisory": "RHSA-2003:116", "cpe": "cpe:/a:redhat:stronghold:4", "product_name": "Red Hat Stronghold 4", "release_date": "2003-03-28T00:00:00Z"}], "bugzilla": {"description": "security flaw", "id": "1616986", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616986"}, "csaw": false, "details": ["OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal)."], "name": "CVE-2003-0147", "public_date": "2003-03-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2003-0147\nhttps://nvd.nist.gov/vuln/detail/CVE-2003-0147"], "statement": "Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.", "threat_severity": "Important"}