CVE-2024-11862: Detailed Vulnerability Analysis and Overview

CVE-2024-11862 Vulnerability Summary

Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks

CVE-2024-11862: Detailed Information and External References

EPSS

0.00043

EPSS %

0.10702

References

0.00043

• https://github.com/Devolutions/XTS.NET/security/advisories/GHSA-j6vm-4r7g-x4gr

CWE

CWE-385

CAPEC

0.00043

• Cross-Domain Search Timing: An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.