Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

libcrypt++ 5.6.2 may let attackers steal private keys

CVE-2015-2141 · published 11 years ago
Summary

The encryption library libcrypt++ version 5.6.2 has a flaw that allows a remote attacker to discover secret keys by measuring how long certain operations take. With those keys, an attacker could fake signatures or read data that should be protected. Install the newer libcrypt++ release or apply the vendor’s security patch right away.

What to do
  • Update debian libcrypto++ to version 5.6.1-7.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian libcrypto++ < 5.6.1-7
Fix: upgrade to 5.6.1-7
Debian:13 debian libcrypto++ < 5.6.1-7
Fix: upgrade to 5.6.1-7
Debian:14 debian libcrypto++ < 5.6.1-7
Fix: upgrade to 5.6.1-7
– cryptopp crypto\+\+_library 5.6.2
cpe:2.3:a:cryptopp:crypto\+\+_library:5.6.2:*:*:*:*:*:*:*
– opensuse opensuse 13.1
13.2
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Original advisory text
The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows rem...
The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.
References
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published1 Jul 2015
Updated31 Oct 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2015-2141 · OSV
CVE-2015-2141 · NVD
Track software like this
Free during beta