---
id: CVE-2022-4304
title: >-
  A timing based side channel exists in the OpenSSL RSA Decryption
  implementation

  which could be sufficient to recover a plaintext across a network in a

  Bleichenbacher style attack
summary: >-
  A timing based side channel exists in the OpenSSL RSA Decryption
  implementation

  which could be sufficient to recover a plaintext across a network in a

  Bleichenbacher style attack. To achieve a successful decryption an attacker

  would have…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-203
  - CWE-203
vendor: openssl
product: openssl
affected:
  - 'openssl >= 1.0.2, < 1.0.2zg'
  - 'openssl >= 1.1.1, < 1.1.1t'
  - 'openssl >= 3.0.0, < 3.0.8'
  - endpoint_security < 7.2.40
  - sslvpn < 3.2.1
  - 'stormshield_network_security >= 2.7.0, < 2.7.11'
  - 'stormshield_network_security >= 2.8.0, < 3.7.34'
  - 'stormshield_network_security >= 3.8.0, < 3.11.22'
  - 'stormshield_network_security >= 4.0.0, < 4.3.16'
  - 'stormshield_network_security >= 4.4.0, < 4.6.3'
patched:
  - openssl 3.0.8
  - endpoint_security 7.2.40
  - sslvpn 3.2.1
  - stormshield_network_security 4.6.3
published: '2023-02-08'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T15:16:59.863'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-4304'
references:
  - url: 'https://security.gentoo.org/glsa/202402-08'
    label: openssl-security@openssl.org
  - url: 'https://www.openssl.org/news/secadv/20230207.txt'
    label: openssl-security@openssl.org
  - url: 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202402-08'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.openssl.org/news/secadv/20230207.txt'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-203374.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-264814.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-337522.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-556635.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-561322.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-625862.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-699386.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-769027.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-879734.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-943925.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - exploit-available
epss: 0.16195
epssPercentile: 0.96879
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Trinadh465/Openssl-1.1.1g_CVE-2022-4304'
  checkedAt: '2026-10-14T15:36:48.435Z'
exploitAvailable: true
ingestedAt: '2026-10-14T15:36:13.929Z'
---

## Overview

A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an
encrypted pre-master secret to the server. An attacker that had observed a
genuine connection between a client and a server could use this flaw to send
trial messages to the server and record the time taken to process them. After a
sufficiently large number of messages the attacker could recover the pre-master
secret used for the original connection and thus be able to decrypt the
application data sent over that connection.

## Affected

- `openssl >= 1.0.2, < 1.0.2zg`
- `openssl >= 1.1.1, < 1.1.1t`
- `openssl >= 3.0.0, < 3.0.8`
- `endpoint_security < 7.2.40`
- `sslvpn < 3.2.1`
- `stormshield_network_security >= 2.7.0, < 2.7.11`
- `stormshield_network_security >= 2.8.0, < 3.7.34`
- `stormshield_network_security >= 3.8.0, < 3.11.22`
- `stormshield_network_security >= 4.0.0, < 4.3.16`
- `stormshield_network_security >= 4.4.0, < 4.6.3`

## Remediation

Upgrade past the affected range:

- `openssl 3.0.8`
- `endpoint_security 7.2.40`
- `sslvpn 3.2.1`
- `stormshield_network_security 4.6.3`