Vulnerability Description
Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cryptopp | Crypto\+\+ | <= 8.4.0 |
Related Weaknesses (CWE)
References
- https://github.com/weidai11/cryptopp/issues/992ExploitIssue TrackingPatch
- https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_4_0Release Notes
- https://github.com/weidai11/cryptopp/issues/992ExploitIssue TrackingPatch
- https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_4_0Release Notes
FAQ
What is CVE-2022-48570?
CVE-2022-48570 is a vulnerability with a CVSS score of 7.5 (HIGH). Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was no...
How severe is CVE-2022-48570?
CVE-2022-48570 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-48570?
Check the references section above for vendor advisories and patch information. Affected products include: Cryptopp Crypto\+\+.