The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Openssl | Openssl | 1.0.1 (including) | 1.0.1 (including) |
Openssl | Openssl | 1.0.1a (including) | 1.0.1a (including) |
Openssl | Openssl | 1.0.1b (including) | 1.0.1b (including) |
Openssl | Openssl | 1.0.1c (including) | 1.0.1c (including) |
Openssl | Openssl | 1.0.1d (including) | 1.0.1d (including) |
Openssl | Openssl | 1.0.1e (including) | 1.0.1e (including) |
Openssl | Openssl | 1.0.1f (including) | 1.0.1f (including) |
Openssl | Openssl | 1.0.1g (including) | 1.0.1g (including) |
Openssl | Openssl | 1.0.1h (including) | 1.0.1h (including) |
Openssl | Openssl | 1.0.1i (including) | 1.0.1i (including) |
Openssl | Openssl | 1.0.1j (including) | 1.0.1j (including) |
Openssl | Openssl | 1.0.1k (including) | 1.0.1k (including) |
Openssl | Openssl | 1.0.1l (including) | 1.0.1l (including) |
Openssl | Openssl | 1.0.1m (including) | 1.0.1m (including) |
Openssl | Openssl | 1.0.1n (including) | 1.0.1n (including) |
Openssl | Openssl | 1.0.1o (including) | 1.0.1o (including) |
Openssl | Openssl | 1.0.1p (including) | 1.0.1p (including) |
Openssl | Openssl | 1.0.1q (including) | 1.0.1q (including) |
Openssl | Openssl | 1.0.1r (including) | 1.0.1r (including) |
Openssl | Openssl | 1.0.1s (including) | 1.0.1s (including) |
Openssl | Openssl | 1.0.1t (including) | 1.0.1t (including) |
Openssl | Openssl | 1.0.2 (including) | 1.0.2 (including) |
Openssl | Openssl | 1.0.2a (including) | 1.0.2a (including) |
Openssl | Openssl | 1.0.2b (including) | 1.0.2b (including) |
Openssl | Openssl | 1.0.2c (including) | 1.0.2c (including) |
Openssl | Openssl | 1.0.2d (including) | 1.0.2d (including) |
Openssl | Openssl | 1.0.2e (including) | 1.0.2e (including) |
Openssl | Openssl | 1.0.2f (including) | 1.0.2f (including) |
Openssl | Openssl | 1.0.2g (including) | 1.0.2g (including) |
Openssl | Openssl | 1.0.2h (including) | 1.0.2h (including) |