LOW
openssl: RSA side-channel attack
Published Aug 8, 2007
1.2
LOWCVSS 2.0
EPSS 0.40%
Description
The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys.
Affected products
No data.
No data.
Red Hat Enterprise Linux 2.1
openssl-0:0.9.6b-48
Fixed · RHSA-2007:0813
Red Hat Enterprise Linux 3
openssl-0:0.9.7a-33.24
Fixed · RHSA-2007:0813
Red Hat Enterprise Linux 4
openssl-0:0.9.7a-43.17.el4_6.1
Fixed · RHSA-2007:1003
Red Hat Enterprise Linux 5
openssl-0:0.9.8b-8.3.el5_0.2
Fixed · RHSA-2007:0964
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 2.1 | openssl-0:0.9.6b-48 | Fixed | RHSA-2007:0813 |
| Red Hat Enterprise Linux 3 | openssl-0:0.9.7a-33.24 | Fixed | RHSA-2007:0813 |
| Red Hat Enterprise Linux 4 | openssl-0:0.9.7a-43.17.el4_6.1 | Fixed | RHSA-2007:1003 |
| Red Hat Enterprise Linux 5 | openssl-0:0.9.8b-8.3.el5_0.2 | Fixed | RHSA-2007:0964 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
1.2 LOW NVD
AV:L/AC:H/Au:N/C:P/I:N/A:N
Access Vector Local
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
0.40% 0.00404
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
EPSS probability 0.00404
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (10 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 0.40% (0.00404) | 32.35th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.41% (0.00409) | 32.33th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.19% (0.00190) | 38.75th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.05% (0.00046) | 19.16th | v3 (v2023.03.01) |
| May 1, 2024 | 0.04% (0.00045) | 14.49th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.04% (0.00045) | 12.45th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.55% (0.01547) | 74.98th | v2 (v2022.01.01) |
| Feb 23, 2023 | 1.55% (0.01547) | 74.94th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.55% (0.01547) | 72.92th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.55% (0.01547) | 51.82th | v2 (v2022.01.01) |
Weaknesses (0)
No CWE recorded.
References (50)
- http://cvs.openssl.org/chngview?cn=16275 x_refsource_CONFIRM
- http://lists.vmware.com/pipermail/security-announce/2008/000002.html mailing-listx_refsource_MLIST
- http://openssl.org/news/patch-CVE-2007-3108.txt x_refsource_CONFIRM
- http://secunia.com/advisories/26411 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/26893 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27021 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27078 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27097 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27205 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27330 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27770 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27870 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/28368 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/30161 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/30220 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/31467 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/31489 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/31531 third-party-advisoryx_refsource_SECUNIA
- http://security.gentoo.org/glsa/glsa-200710-06.xml vendor-advisoryx_refsource_GENTOO
- http://support.attachmate.com/techdocs/2374.html x_refsource_CONFIRM
- http://support.avaya.com/elmodocs2/security/ASA-2007-485.htm x_refsource_CONFIRM
- http://www.bluecoat.com/support/securityadvisories/advisory_openssl_rsa_key_reconstruction_vulnerability x_refsource_CONFIRM
- http://www.debian.org/security/2008/dsa-1571 vendor-advisoryx_refsource_DEBIAN
- http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml vendor-advisoryx_refsource_GENTOO
- http://www.kb.cert.org/vuls/id/724968 third-party-advisoryx_refsource_CERT-VNUS Government Resource
- http://www.kb.cert.org/vuls/id/RGII-74KLP3 x_refsource_CONFIRM
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:193 vendor-advisoryx_refsource_MANDRIVA
- http://www.redhat.com/support/errata/RHSA-2007-0813.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2007-0964.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2007-1003.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/476341/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/485936/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/486859/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/25163 vdb-entryx_refsource_BIDPatch
- http://www.vmware.com/security/advisories/VMSA-2008-0001.html x_refsource_CONFIRM
- http://www.vmware.com/security/advisories/VMSA-2008-0013.html x_refsource_CONFIRM
- http://www.vupen.com/english/advisories/2007/2759 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/4010 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/0064 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/2361 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/2362 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/2396 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2007-3108 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=245732 Issue Tracking
- https://issues.rpath.com/browse/RPL-1613 x_refsource_CONFIRM
- https://issues.rpath.com/browse/RPL-1633 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2007-3108
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9984 vdb-entrysignaturex_refsource_OVAL
- https://usn.ubuntu.com/522-1/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2007-3108
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Aug 8, 2007
Updated Aug 7, 2024
Reserved Jun 7, 2007
Link CVE-2007-3108
CISA Vulnrichment
Updated n/a