CVE-2018-0737: Cache timing vulnerability in RSA Key Generation

Security readout for executives and security teams

CVE-2018-0737 is a side-channel flaw in OpenSSL RSA key generation. If an attacker can closely observe CPU cache timing while a system generates RSA keys, they may recover the private key. This is not a typical remote web attack; exposure depends on affected OpenSSL versions and attacker proximity or local execution capability. Most likely exposed assets are systems, appliances, containers, or applications using affected OpenSSL builds and generating RSA keys where an attacker can observe cache behavior. Shared compute, local multi-user systems, and cryptographic key generation services deserve closer review. Prioritize patching in environments that generate or manage RSA private keys, especially shared or multi-tenant systems. This is not shown as actively exploited in the provided evidence, but key compromise would have serious confidentiality and trust consequences. Mitigation focus: Apply vendor OpenSSL security updates for affected operating systems.; Upgrade OpenSSL 1.1.0 deployments to 1.1.0i or later.; Upgrade OpenSSL 1.0.2 deployments to 1.0.2p or later..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.