Description

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.

Remediation

References

CVE-2014-0076

Related Vulnerabilities

MediaWiki Improper Input Validation Vulnerability (CVE-2021-31555)

Nexus Repository Manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5307)

Oracle Database Server CVE-2010-2419 Vulnerability (CVE-2010-2419)

WordPress Plugin WP Smart Security PHP Object Injection (1.0)

WordPress Plugin Management App for WooCommerce-Order notifications, Order management, Lead management, Uptime Monitoring Arbitrary File Upload (1.2.2)

Severity

Low

Classification

CVE-2014-0076

Tags

Missing Update Known Vulnerabilities