CVE-2023-46809: High severity ibm cognos analytics vulnerability
A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios involving API endpoints processing Json Web Encryption messages.
This vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x.
Other sources
Node.js could allow a remote attacker to obtain sensitive information, caused by a vulnerability in the privateDecrypt() API of the crypto library. An attacker could exploit this vulnerability to conduct a covert timing side-channel during PKCS#1 v1.5 padding error handling and obtain significant timing differences in decryption for valid and invalid ciphertexts.
— IBM
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46809?
CVE-2023-46809 is considered a serious vulnerability that can lead to timing side-channel attacks during PKCS#1 v1.5 padding error handling.
How do I fix CVE-2023-46809?
To fix CVE-2023-46809, update the affected software to the latest patched versions provided by the vendor.
Which software does CVE-2023-46809 affect?
CVE-2023-46809 affects Node.js and different versions of IBM Cognos Analytics.
What type of attack can be performed using CVE-2023-46809?
CVE-2023-46809 allows attackers to exploit timing differences in decryption processes, potentially revealing sensitive data.
Is there a patch available for CVE-2023-46809?
Yes, patches are available for the affected versions of both Node.js and IBM Cognos Analytics.