CVE-2022-48570

State: Published
Severity: Not scored
Published: Aug 22, 2023
Updated: Oct 3, 2024
Reserved: Jul 23, 2023

Description

Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_4_0
https://github.com/weidai11/cryptopp/issues/992

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.