WaratekVRT Sign in

CVE-2024-13176

Affected software10 products, listed below
Severity4.6 Medium CVSS 3.1
WeaknessCWE-385
Published20 Jan 2025
Updated9 Nov 2026

Description

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 0.75% chance in 30 days

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Instrumented analysis and reproducibility materials for ECDSA timing leakage in OpenSSL CVE-2024-13176 2026-08-19

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Security Patch Update August 2026 ↗ CSPU 2026-Q3 Oracle Commerce / Forge (OpenSSL) (11.4.0)
Oracle Critical Patch Update July 2025 ↗ CPU 2025-Q3 Oracle JD Edwards / World Software Security (OpenSSL) (A9.4)
Oracle Critical Patch Update April 2025 ↗ CPU 2025-Q2 Oracle Database Server / Oracle Database (OpenSSL) (23.4-23.7)
Oracle Essbase / Web Platform (OpenSSL) (21.7.1.0.0)
Oracle MySQL / Connector/C++ (OpenSSL) (9.0.0-9.2.0)
Oracle MySQL / Connector/ODBC (OpenSSL) (9.0.0-9.2.0)
Oracle MySQL / Enterprise Backup (OpenSSL) (8.0.0-8.0.41, 8.4.0-8.4.4, 9.0.0-9.2.0)
Oracle MySQL / MySQL Workbench (OpenSSL) (8.0.0-8.0.41)
Oracle MySQL / Server: Packaging (OpenSSL) (8.0.0-8.0.41, 8.4.0-8.4.4, 9.0.0-9.2.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Commerce Forge (OpenSSL) 11.4.0 11.4.0
Oracle Database Server Oracle Database (OpenSSL) 23.4-23.7
Oracle Essbase Web Platform (OpenSSL) 21.7.1.0.0 21.7.1.0.0
Oracle JD Edwards World Software Security (OpenSSL) A9.4
Oracle MySQL Connector/C++ (OpenSSL) 9.0.0-9.2.0
Oracle MySQL Connector/ODBC (OpenSSL) 9.0.0-9.2.0
Oracle MySQL Enterprise Backup (OpenSSL) 8.0.0-8.0.41, 8.4.0-8.4.4, 9.0.0-9.2.0
Oracle MySQL MySQL Workbench (OpenSSL) 8.0.0-8.0.41
Oracle MySQL Server: Packaging (OpenSSL) 8.0.0-8.0.41, 8.4.0-8.4.4, 9.0.0-9.2.0

Products and versions

30 products, 40 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 11.0
nvd netapp 500f firmware generic any version
nvd netapp 8300 firmware generic any version
nvd netapp 8700 firmware generic any version
nvd netapp a250 firmware generic any version
nvd netapp a400 firmware generic any version
nvd netapp a700s firmware generic any version
nvd netapp active iq unified manager generic any version · ＜ 9.18
nvd netapp bootstrap os generic any version
nvd netapp brocade fabric operating system generic any version
nvd netapp c250 firmware generic any version
nvd netapp c400 firmware generic any version
nvd netapp h300s firmware generic any version
nvd netapp h410c firmware generic any version
nvd netapp h410s firmware generic any version
nvd netapp h500s firmware generic any version
nvd netapp h610c firmware generic any version
nvd netapp h610s firmware generic any version
nvd netapp h615c firmware generic any version
nvd netapp h700s firmware generic any version
nvd netapp manageability software development kit generic any version
nvd netapp management services for element software and netapp hci generic any version
nvd netapp oncommand insight generic any version
nvd netapp oncommand workflow automation generic any version
nvd netapp ontap tools generic 9
nvd netapp snapcenter generic ≤ 6.0.1 · 6.1 · 6.1:p1 · 6.1:p2
nvd netapp snapmanager generic any version
nvd netapp solidfire \& hci management node generic any version
nvd netapp solidfire \& hci storage node generic any version
nvd openssl openssl generic ≥ 1.0.2 and ＜ 1.0.2 · ≥ 1.1.1 and ＜ 1.1.1 · ≥ 3.0.0 and ＜ 3.0.16 · ≥ 3.1.0 and ＜ 3.1.8 · ≥ 3.2.0 and ＜ 3.2.4 · ≥ 3.3.0 and ＜ 3.3.3 · ≥ 3.4.0 and ＜ 3.4.1

References

URLTags
https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844 Patch
https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467 Patch
https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902 Patch
https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65 Patch
https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f Patch
https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded Permissions Required
https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86 Permissions Required
https://openssl-library.org/news/secadv/20250120.txt Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/01/20/2 Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html Mailing List, Third Party Advisory

Timeline
Published2025-01-20By the CVE Program.
NVD record modified2026-11-09NVD's own last-modified date for this record.