Description
Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.
Published: 2025-08-29
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Affected users should upgrade to ocrypto 3.9.2 or later.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-28779 Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.
History

Fri, 29 Aug 2025 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 29 Aug 2025 09:30:00 +0000

Type Values Removed Values Added
Description Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since 3.1.0 and prior to 3.9.2 allows an attacker to recover plaintexts via timing measurements of AES-CBC PKCS#7 decrypt operations.
Title Timing side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto library
Weaknesses CWE-208
CWE-327
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published:

Updated: 2025-08-29T12:07:57.827Z

Reserved: 2025-07-04T14:16:55.641Z

Link: CVE-2025-7071

cve-icon Vulnrichment

Updated: 2025-08-29T12:07:54.803Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-08-29T10:15:32.630

Modified: 2025-08-29T16:24:29.730

Link: CVE-2025-7071

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses