CVE-2024-28285
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of...
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- Record
CVE-2024-28285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285, CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2024-25384
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- Record
EUVD-2024-25384- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w4c4-h4jq-x3xh
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of...
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- Record
GHSA-w4c4-h4jq-x3xh- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- Record
CVE-2024-28285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-209, CWE-285
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-28285
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- Record
DEBIAN-CVE-2024-28285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-28285
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- Record
UBUNTU-CVE-2024-28285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV No score
A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-reside in the same system with a victim process to disclose information and escalate privileges.
- Record
CVE-2024-28285- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15627-1 No score
libcryptopp-devel-8.9.0-4.1 on GA media
These are all security issues fixed in the libcryptopp-devel-8.9.0-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15627-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01816-1 No score
Security update for libcryptopp
This update for libcryptopp fixes the following issues:
- CVE-2024-28285: Fixed potential leak of secret key of ElGamal encryption via fault injection (bsc#1224280)
- Record
SUSE-SU-2025:01816-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:01939-1 No score
Security update for libcryptopp
This update for libcryptopp fixes the following issues:
- CVE-2024-28285: Fixed potential leak of secret key of ElGamal encryption via fault injection (bsc#bsc#1224280).
- Record
SUSE-SU-2025:01939-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcrypto++Debian:12 |
All versions, plus listed versions 8.7.0+git220824-18.8.0-18.8.0-28.9.0-18.9.0-1.18.9.0-1.1~exp18.9.0-28.9.0-3 |
None known |
libcrypto++Debian:13 |
All versions, plus listed versions 8.9.0-28.9.0-3 |
None known |
libcrypto++Debian:14 |
All versions, plus listed versions 8.9.0-28.9.0-3 |
None known |
libcryptoppSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libcryptoppSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Manager Proxy 4.3 |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Manager Server 4.3 |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppopenSUSE:Leap 15.6 |
before 8.6.0-150400.3.9.1 | 8.6.0-150400.3.9.1 |
libcryptoppSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 5.6.5-150000.1.15.1 | 5.6.5-150000.1.15.1 |
libcryptoppSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 5.6.5-150000.1.15.1 | 5.6.5-150000.1.15.1 |
libcryptoppSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 5.6.5-150000.1.15.1 | 5.6.5-150000.1.15.1 |
libcryptoppSUSE:Enterprise Storage 7.1 |
before 5.6.5-150000.1.15.1 | 5.6.5-150000.1.15.1 |
libcrypto++Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 5.6.1-65.6.1-6+deb8u1build0.14.04.15.6.1-6+deb8u3build0.14.04.15.6.1-6+deb8u3ubuntu0.1~esm1 |
None known |
libcrypto++Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.6.1-85.6.1-95.6.1-9ubuntu0.15.6.1-9ubuntu0.1+esm1 |
None known |
libcrypto++Ubuntu:18.04:LTS |
All versions, plus listed versions 5.6.4-8 |
None known |
libcrypto++Ubuntu:20.04:LTS |
All versions, plus listed versions 5.6.4-95.6.4-9build1 |
None known |
libcrypto++Ubuntu:22.04:LTS |
All versions, plus listed versions 8.4.0-18.6.0-2ubuntu1 |
None known |
libcrypto++Ubuntu:24.04:LTS |
All versions, plus listed versions 8.8.0-18.9.0-18.9.0-1.18.9.0-1.1build1 |
None known |
libcrypto++Ubuntu:25.10 |
All versions, plus listed versions 8.9.0-1.1build18.9.0-2 |
None known |
libcrypto++Ubuntu:26.10 |
All versions, plus listed versions 8.9.0-2build18.9.0-3 |
None known |
libcrypto++Ubuntu:26.04:LTS |
All versions, plus listed versions 8.9.0-28.9.0-2build1 |
None known |
libcryptoppopenSUSE:Tumbleweed |
before 8.9.0-4.1 | 8.9.0-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28285 is a critical vulnerability (CVSS 9.8) in Cryptopp Crypto\+\+, published May 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in libcryptopp 8.6.0-150400.3.9.1.