RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels

[reimarstier]

The designated openidconnect crate has a side channel vulnerability:

https://rustsec.org/advisories/RUSTSEC-2023-0071

Details
Crate	RSA
Version	0.9.6
Title	Marvin Attack: potential key recovery through timing side channels
Date	2023-11-22
ID	RUSTSEC-2023-0071
URL	https://rustsec.org/advisories/RUSTSEC-2023-0071
Severity	5.9 (medium)
Solution	No fixed upgrade is available!

• tarcieri (Member of https://github.com/RustCrypto) commented Feb 15, 2024:

  We are aware, this is in fact the repository that contains the vulnerable crate: it was originally filed as issue 19, and we are working on a fix in pull request 394

• References:

  • WIP: switch to crypto-bigint for decryption #394
  • modpow implementation is not constant-time #19

This issue is to track the progress of the fix and shall be a reminder to remove the ignored advisory once it has been fixed.