CVE-2022-4304

CVE-2022-4304 is a timing-based side-channel vulnerability in OpenSSL's RSA decryption implementation, affecting all RSA padding modes across various OpenSSL and Stormshield products. This medium-severity flaw (CVSS 5.9) allows a remote attacker to potentially recover plaintext data, such as a TLS pre-master secret, through a Bleichenbacher-style attack by sending a very large number of trial messages and analyzing processing times. While the attack complexity is high, successful exploitation could lead to full decryption of sensitive application data. There is no known active exploitation, exploit code, or Metasploit/Nuclei modules, though it has garnered significant community discussion and media coverage.