Compliance Impact

The vulnerability described in CVE-2026-42768 allows an attacker to decrypt or sign messages using the victim's private RSA key through a Bleichenbacher-style attack on the CMS_decrypt and PKCS7_decrypt functions.

This could potentially lead to unauthorized access to sensitive encrypted data or the forging of signatures, which may impact the confidentiality and integrity of data protected under regulations such as GDPR and HIPAA.

However, the CVE notes that no known applications currently provide a remote attacker the opportunity to mount this attack, and the issue is rated as Low severity.

Additionally, the FIPS modules in OpenSSL versions 4.0, 3.6, 3.5, and 3.4 are not affected, as CMS and S/MIME processing occurs outside the FIPS module boundary.

Therefore, while the vulnerability could theoretically affect compliance by exposing sensitive encrypted data or allowing signature forgery, the practical risk is considered low due to the unlikely attack scenarios and mitigations.

Useful 0 Not Useful 0

Executive Summary

The vulnerability involves the CMS_decrypt and PKCS7_decrypt functions being susceptible to a Bleichenbacher-style attack. This attack allows an attacker who can provide CMS or S/MIME messages and observe error codes or decryption outputs to decrypt or sign messages using the victim's private RSA key.

There are two variants of the attack: one where the decryption API is used without providing the recipient certificate, allowing an attacker to iterate over multiple KeyTransRecipientInfo entries to find valid PKCS#1 v1.5 padding; and another where the API is provided with a recipient certificate but the recipient is not found, causing a random key substitution that can be exploited if error codes and decryption results are observable.

This attack exploits an adaptive-chosen-ciphertext side channel known as a Bleichenbacher oracle, enabling decryption of any RSA ciphertext or forging of PKCS#1 v1.5 signatures under the victim's key.

The issue is considered low severity because no known applications provide remote attackers the opportunity to mount this attack.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker to decrypt messages or forge signatures using the victim's private RSA key by leveraging the vulnerable decryption functions.

This could lead to unauthorized access to encrypted information or the ability to impersonate the victim by signing messages.

However, the likelihood of such an attack is considered very low due to the rarity of applications exposing the necessary conditions for the attack.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the CMS_decrypt and PKCS7_decrypt functions being vulnerable to a Bleichenbacher-style attack when an attacker can provide CMS or S/MIME messages and observe error codes or decryption output.

Detection would require monitoring for unusual error codes or decryption outputs when processing CMS or S/MIME messages, especially if the application uses RSA PKCS#1 v1.5 Key Transport without proper recipient certificate validation.

However, the provided context does not include specific commands or tools to detect this vulnerability on a network or system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that when using RSA PKCS#1 v1.5 Key Transport, the decryption API (CMS_decrypt(), PKCS7_decrypt()) is invoked with the recipient certificate provided to identify the particular RecipientInfo for decryption.

This prevents the attacker from exploiting the Bleichenbacher oracle by avoiding iteration over multiple KeyTransRecipientInfo entries.

Additionally, use OpenSSL versions where the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance is enabled, as this mechanism helps prevent the attack by always returning a deterministic plaintext value.

Note that FIPS modules in OpenSSL versions 4.0, 3.6, 3.5, and 3.4 are not affected by this issue.

Useful 0 Not Useful 0