Threats tagged 'ghsa-q4gq-r6f8-q6q9'

A timing and cache side-channel vulnerability affects SM2 private key operations on ARM64 and RISC-V platforms in certain OpenSSL versions used by Node.js. The scalar point multiplication implementation is not constant-time, which could allow attackers measuring timing or cache patterns during SM2 signing or decryption to gain information about secret scalars. This vulnerability impacts OpenSSL versions 4.0, 3.6, 3.5, and 3.4 but does not affect versions 3.0, 1.1.1, or 1.0.2. Fixes have been released in OpenSSL 4.0.3, 3.6.5, 3.5.9, and 3.4.8. The CVSS score is 3.7, indicating low severity.