CVE-2023-49092

MEDIUM LAB

RustCrypto RSA - Covert Timing Channel via Non-Constant-Time Implementation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-49092. PoCs published by omonuj.

AI-analyzed exploit summary This repository provides a functional exploit and remediation script for CVE-2023-49092, a Kubernetes-based configuration and mTLS validation vulnerability in the 'bleater' fanout service. The exploit neutralizes drift sources, regenerates compliant TLS certificates, and deploys a live fan-out distributor to restore secure message distribution.

Description

RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. There is currently no fix available. As a workaround, avoid using the RSA crate in settings where attackers are able to observe timing information, e.g. local use on a non-compromised computer.

Exploits (1)

nomisec WORKING POC
by omonuj · poc
https://github.com/omonuj/fanout-cve-rollout

This repository provides a functional exploit and remediation script for CVE-2023-49092, a Kubernetes-based configuration and mTLS validation vulnerability in the 'bleater' fanout service. The exploit neutralizes drift sources, regenerates compliant TLS certificates, and deploys a live fan-out distributor to restore secure message distribution.

Classification
Working Poc 98%
Attack Type
Auth Bypass
Complexity
Complex
Reliability
Reliable
Target: bleater fanout-service (versions 1.4.0, 1.4.1, 1.4.2)
Auth required
Prerequisites: Kubernetes cluster access with permissions to modify deployments, ConfigMaps, Secrets, and RBAC in the 'bleater' namespace · Access to platform audit artefacts (/etc/bleater/install-id.txt, /etc/bleater/rollout-attestation.txt, /etc/bleater/cert-policy.txt)
mistral-large-3 · analyzed Jul 19, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 5.9
EPSS 0.0061
EPSS Percentile 45.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Lab Environment

COMMUNITY
Community Lab
docker pull us-central1-docker.pkg.dev/bespokelabs/nebula-devops-registry/nebula-devops:1.1.0

Details

CWE
CWE-203 CWE-385
Status published
Products (2)
crates.io/rsa 0crates.io
rustcrypto/rsa
Published Nov 28, 2023
Tracked Since Feb 18, 2026