Vulnerability GHSA-4grx-2x9w-596c
Medium Risk
MEDIUM RISK
CVSS Score: 5.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 years ago
November 28, 2023 at 11:28 PM UTC
Marvin Attack: potential key recovery through timing sidechannels
<=0.9.6
<=0.9.6
Summary
Marvin Attack: potential key recovery through timing sidechannels
Details
The Marvin Attack is a timing sidechannel vulnerability which allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed withthe private key.
A recent survey of RSA implementations found that the Rust rsa crate is one of many implementations vulnerable to this attack.
No fixed version is available at this time.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
10 months ago
rsa crate has potential panic on a prime being equal to 1
<0.9.10 GHSA-9c48-w39g-hm26
<0.9.10 GHSA-9c48-w39g-hm26
Medium Risk
2 years ago
Marvin Attack: potential key recovery through timing sidechannels
<=0.9.6 GHSA-c38w-74pg-36hr
<=0.9.6 GHSA-c38w-74pg-36hr
Medium Risk
2 years ago
Marvin Attack: potential key recovery through timing sidechannels
>=0.0.0-0 <0.10.0 RUSTSEC-2023-0071
>=0.0.0-0 <0.10.0 RUSTSEC-2023-0071
Impacted packages
Timeline
Published
2 years ago
November 28, 2023 at 11:28 PM UTC
Last Modified
2 months ago
September 10, 2026 at 03:50 AM UTC