Vulnerability Details CVE-2022-48570
Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 65.9%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2022-48570
-
cpe:2.3:a:cryptopp:crypto++:5.0
-
cpe:2.3:a:cryptopp:crypto++:5.1
-
cpe:2.3:a:cryptopp:crypto++:5.2
-
cpe:2.3:a:cryptopp:crypto++:5.2.1
-
cpe:2.3:a:cryptopp:crypto++:5.2.3
-
cpe:2.3:a:cryptopp:crypto++:5.3.0
-
cpe:2.3:a:cryptopp:crypto++:5.4
-
cpe:2.3:a:cryptopp:crypto++:5.5
-
cpe:2.3:a:cryptopp:crypto++:5.5.1
-
cpe:2.3:a:cryptopp:crypto++:5.5.2
-
cpe:2.3:a:cryptopp:crypto++:5.6.0
-
cpe:2.3:a:cryptopp:crypto++:5.6.1
-
cpe:2.3:a:cryptopp:crypto++:5.6.2
-
cpe:2.3:a:cryptopp:crypto++:5.6.3
-
cpe:2.3:a:cryptopp:crypto++:5.6.4
-
cpe:2.3:a:cryptopp:crypto++:5.6.5
-
cpe:2.3:a:cryptopp:crypto++:6.0.0
-
cpe:2.3:a:cryptopp:crypto++:6.1.0
-
cpe:2.3:a:cryptopp:crypto++:7.0.0
-
cpe:2.3:a:cryptopp:crypto++:8.0.0
-
cpe:2.3:a:cryptopp:crypto++:8.1.0
-
cpe:2.3:a:cryptopp:crypto++:8.2.0
-
cpe:2.3:a:cryptopp:crypto++:8.3.0
-
cpe:2.3:a:cryptopp:crypto++:8.4.0