CVE-2003-0147 - CVE House
Back to Database
Status published Medium CVE-2003-0147

OpenSSL does not use RSA blinding by default, which allows...

Vulnerability Description

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2003-0147

Credits & Attribution

No credits recorded in the NVD database.

References

More from openpkg

View All →
CVE-2004-1065
Buffer overflow in the exif_read_data function in PHP before 4.3.10...
Critical 10
CVE-2004-1019
The deserialization code in PHP before 4.3.10 and PHP 5.x...
Critical 10
CVE-2004-0957
Unknown vulnerability in MySQL 3.23.58 and earlier, when a local...
Medium 6.8
CVE-2004-0918
The asn_parse_header function (asn1.c) in the SNMP module for Squid...
Medium 5
CVE-2004-0594
The memory_limit functionality in PHP 4.x up to 4.3.7, and...
Medium 5.1

Affected Vendor

Affected Software

openpkg, openssl, stunnel
Vulnerable Versions:
1.1, 1.2, 0.9.6, 0.9.6a, 0.9.6b, 0.9.6c, 0.9.6d, 0.9.6e, 0.9.6g, 0.9.6h, 0.9.6i, 0.9.7, 0.9.7a, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 4.0, 4.01, 4.02, 4.03, 4.04

Timeline

Official Publish: March 18th, 2003
Last Modified: August 8th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.