CVE-2024-22340 - Vulnerability Details - OpenCVE

IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	4769

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7185282

History

Tue, 11 Mar 2025 02:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 11 Mar 2025 01:00:00 +0000

Type	Values Removed	Values Added
Description		IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack.
Title		IBM Common Cryptographic Architecture information disclosure
First Time appeared		Ibm Ibm 4769
Weaknesses		CWE-208
CPEs		cpe:2.3:h:ibm:4769:-:::::::*
Vendors & Products		Ibm Ibm 4769
References		https://www.ibm.com/support/pages/node/7185282
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-03-11T00:50:55.148Z

Updated: 2025-03-11T02:01:05.199Z

Reserved: 2024-01-08T23:42:17.267Z

Link: CVE-2024-22340

Vulnrichment

Updated: 2025-03-11T02:01:00.637Z

NVD

Status : Received

Published: 2025-03-11T01:15:33.257

Modified: 2025-03-11T01:15:33.257

Link: CVE-2024-22340

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22340", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-01-08T23:42:17.267Z", "datePublished": "2025-03-11T00:50:55.148Z", "dateUpdated": "2025-03-11T02:01:05.199Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:h:ibm:4769:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "platforms": ["Linux x86", "IBM AIX", "IBM i", "IBM PowerLinux"], "product": "Common Cryptographic Architecture", "vendor": "IBM", "versions": [{"lessThanOrEqual": "7.5.51", "status": "affected", "version": "7.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "4769 Developers Toolkit", "vendor": "IBM", "versions": [{"lessThanOrEqual": "7.5.51", "status": "affected", "version": "7.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 \n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack.</span>\n\n</span>"}], "value": "IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 \n\n\n\ncould allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-03-11T00:50:55.148Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7185282"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Common Cryptographic Architecture information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-11T02:00:44.991344Z", "id": "CVE-2024-22340", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T02:01:05.199Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22340", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-11T02:00:44.991344Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T02:01:00.637Z"}}], "cna": {"title": "IBM Common Cryptographic Architecture information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:h:ibm:4769:-:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Common Cryptographic Architecture", "versions": [{"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.5.51"}], "platforms": ["Linux x86", "IBM AIX", "IBM i", "IBM PowerLinux"], "defaultStatus": "unaffected"}, {"vendor": "IBM", "product": "4769 Developers Toolkit", "versions": [{"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.5.51"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7185282", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 \n\n\n\ncould allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack.", "supportingMedia": [{"type": "text/html", "value": "IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 \n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">could allow a remote attacker to obtain sensitive information during the creation of ECDSA signatures to perform a timing-based attack.</span>\n\n</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-03-11T00:50:55.148Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22340", "state": "PUBLISHED", "dateUpdated": "2025-03-11T02:01:05.199Z", "dateReserved": "2024-01-08T23:42:17.267Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-03-11T00:50:55.148Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}