Description
OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.7b-1 | — |
| Debian 13 | openssl | 0.9.7b-1 | — |
| Debian 12 | openssl | 0.9.7b-1 | — |
| Debian 3.0 | openssl | 0.9.6c-2.woody.3 | DSA-288 |
Advisories 1
- DSA-288 openssl - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-288 vendor-advisory
- RHSA-2003:101 vendor-advisory
- RHSA-2003:102 vendor-advisory
- http://www.openssl.org/news/secadv_20030317.txt
- GLSA-200303-15 vendor-advisory
- 20030325 Fwd: APPLE-SA-2003-03-24 Samba, OpenSSL mailing-list
- 20030317 [ADVISORY] Timing Attack on OpenSSL mailing-list
- MDKSA-2003:035 vendor-advisory
- http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
- GLSA-200303-23 vendor-advisory
- oval:org.mitre.oval:def:466 vdb-entry signature
- OpenPKG-SA-2003.019 vendor-advisory
- GLSA-200303-24 vendor-advisory
- IMNX-2003-7+-001-01 vendor-advisory
- 20030313 Vulnerability in OpenSSL mailing-list
- 20030320 [OpenPKG-SA-2003.026] OpenPKG Security Advisory (openssl) mailing-list
- CLA-2003:625 vendor-advisory
- VU#997481 third-party-advisory
- 20030313 OpenSSL Private Key Disclosure mailing-list