What is CVE-2022-4304?
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
Timeline
- 2023-02-08Published to the U.S. National Vulnerability Database (NVD)
- 2026-06-17NVD record last updated
Affected product
Openssl (also: Stormshield)
NVD also lists CPE entries for: Openssl, Stormshield Endpoint Security, Stormshield Sslvpn, Stormshield Network Security
Remediation Steps
- Contact Hitachi Energy for the latest GMS600 firmware that addresses the OpenSSL vulnerability
- Review the version of OpenSSL bundled in your GMS600 deployment against known vulnerable releases
- Plan a maintenance window for firmware update deployment
- Test the update in a non-production environment before deploying to operational systems
References
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 22 of May 2026 (May 25 – 31)
Browse all tracked CVEs in the defend.network CVE database →