Bug 1224280 (CVE-2024-28285)

Summary:	VUL-0: CVE-2024-28285: libcryptopp: potential leak of secret key of ElGamal encryption via fault injection
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Pedro Monreal Gonzalez <pmonrealgonzalez>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	camila.matos, pascal.bleser, pgajdos, pmonrealgonzalez, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/405094/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-28285:7.0:(AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-05-15 10:31:58 UTC

A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28285
https://www.cve.org/CVERecord?id=CVE-2024-28285
https://gist.github.com/liang-junkai/3e91f58070812ea76c1b8c126c3e28c7
https://bugzilla.redhat.com/show_bug.cgi?id=2280418

Comment 2 Petr Gajdos 2024-05-15 16:54:47 UTC

https://github.com/weidai11/cryptopp/issues/1262

No news upstream.

Comment 3 Petr Gajdos 2024-05-22 10:13:07 UTC

Reassigning to current maintainer. Thanks Pedro