Technical impact
Applications using RSA/RSASVE key encapsulation can mistakenly treat a failure of RSA_public_encrypt as a success because the code only checks for a non‑zero return value. When encryption fails, the function still returns a length and the caller believes a valid KEM ciphertext was produced, causing stale or uninitialized ciphertext data to be sent to a peer. The contents of that buffer may contain previously used memory and can reveal secrets or other sensitive information. This flaw is a case of improper failure handling (CWE‑754) and insecure data exposure (CWE‑824).
Affected Systems
The OpenSSL library and all FIPS modules in versions 3.0 through 3.6 are affected. Any application that links against these releases and performs RSA/RSASVE encapsulation without validating the RSA public key may be vulnerable.
Risk and Exploitability
The CVSS score of 7.5 indicates medium‑to‑high severity and the EPSS score of less than 1% suggests a low current exploitation probability; it is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can trigger the failure path by submitting an invalid RSA public key to the vulnerable application. If the application exposes a network or interprocess interface that accepts such keys, the attack may be remote; otherwise, local or privileged access might be required. The exploitation results in memory contents leaking from the victim’s address space, potentially revealing private keys, configuration data, or other sensitive items, but the risk level depends heavily on how the application validates keys and handles errors.
Debian DSA
Ubuntu USN