Loading story…
OpenSSL disclosed CVE-2018-0737, a low-severity cache-timing side channel in RSA private-key generation affecting versions before 1.0.2p and 1.1.0i. Three non-constant-time execution paths, including BN_gcd, could leak sensitive state to an attacker able to run a precisely timed cache attack on the same physical system while a key is generated, potentially allowing recovery of the newly generated RSA private key. Researchers demonstrated recovery through the BN_gcd path at an approximately 30% success rate across more than 10,000 cluster trials.
OpenSSL incorporated fixes into 1.0.2p and 1.1.0i, with patches also available through upstream commits 349a41da1 and 6939eab03. Exploitation requires stringent local or adjacent-system access and observation at the moment of key generation, limiting practical exposure; keys generated and retained in hardware security modules are not affected. Red Hat issued fixes for affected RHEL 7 and later systems and JBoss Core Services products.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
OpenSSL disclosed CVE-2018-0737, a low-severity cache-timing side-channel vulnerability in RSA key generation that could allow local or adjacent attackers to recover a newly generated private key. It published fixes in the 1.0.2 and 1.1.0 branch commits, to be included in OpenSSL 1.0.2p and 1.1.0i, while the researchers also disclosed technical details to oss-security.
The researchers notified the distros mailing list about the OpenSSL RSA key-generation vulnerabilities ahead of public disclosure.
The researchers notified OpenSSL again with a proof of concept for the RSA key-generation cache-timing attack and set a public-disclosure embargo for April 16 at 15:00 UTC.
Researchers initially notified OpenSSL, LibreSSL, and BoringSSL about the RSA key-generation cache-timing issues. LibreSSL subsequently fixed the issues in its codebase.
Red Hat addressed CVE-2018-0737 through updates for Red Hat Enterprise Linux 7 and through advisories for Red Hat JBoss Core Services, including deployments on RHEL 6 and RHEL 7.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceopenssl.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers demonstrated that **remote timing attacks** against OpenSSL could recover long-term private keys from general-purpose servers, overturning the assumption that such side channels were only practical against local devices. One line of work showed that OpenSSL `0.9.7` systems using RSA without blinding—including deployments such as **Apache `mod_ssl`** and **stunnel**—leaked enough information during CRT-based decryption to extract a `1024-bit` RSA private key with roughly **1 million to 1.4 million queries** in about **two hours** under typical conditions. The leakage stemmed from timing differences tied to Montgomery extra reductions and the choice between Karatsuba and normal multiplication, and the attack was shown to work across processes, virtual machines, and routed campus networks.
Jun 29, 2026
OpenSSL remediated three vulnerabilities: **CVE-2019-1547**, an ECDSA timing side channel that could expose private keys when applications use explicit EC parameters without a cofactor; **CVE-2019-1549**, in which OpenSSL 1.1.1–1.1.1c may allow parent and child processes to share RNG state after `fork()`; and **CVE-2019-1563**, a Bleichenbacher-style RSA padding oracle in CMS/PKCS#7 decryption. Exploiting the ECDSA and CMS issues requires many observed signature timings or chosen-ciphertext decryption attempts, respectively; normal TLS use through `libssl` is not affected by CVE-2019-1547. Upstream fixes are available in OpenSSL 1.1.1d, 1.1.0l, and 1.0.2t, with CVE-2019-1549 fixed in 1.1.1d. Red Hat shipped backported fixes for affected JBoss Core Services Apache HTTP Server packages and RHEL 8 OpenSSL packages, advising customers to restart OpenSSL-linked services or reboot after installation. Slackware also released updated OpenSSL packages for 14.2 and -current. Organizations should patch supported OpenSSL deployments and prioritize review of applications that use explicit EC parameters, CMS/PKCS#7 RSA decryption, or forked processes relying on cryptographic randomness.
Aug 28, 2026
OpenSSL released fixes for seven vulnerabilities across multiple supported branches, led by **CVE-2026-31790**, a Moderate-severity flaw in RSA KEM `RSASVE` encapsulation that can leak stale or uninitialized memory to a malicious peer. The issue can be triggered when applications process attacker-supplied invalid RSA public keys without validating them first. The advisory also disclosed six Low-severity bugs: an AVX-512/VAES-specific out-of-bounds read in AES-CFB-128, a potential use-after-free or double-free in DANE client code, two CMS-related NULL pointer dereferences, a delta CRL NULL dereference, and a heap buffer overflow in hexadecimal conversion on 32-bit platforms. The project advised users to upgrade to fixed releases **3.0.20**, **3.3.7**, **3.4.5**, **3.5.6**, and **3.6.2**, with premium-support fixes available for **1.1.1zg** and **1.0.2zp** where applicable. OpenSSL said branches **3.1** and **3.2** are out of support and were not analyzed, leaving organizations running those versions without reviewed fixes in this advisory.
Jun 29, 2026