# CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA Decryption

Source: https://junglewise.ai/threats/cve-2022-4304-hitachi-energy-gms600-observable-discrepancy-in-openssl-rsa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-02-07. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2022-4304 · Severity: high · CVSS 3.1 · Published 2023-02-07

Hitachi Energy GMS600 is a monitoring system used in electrical power grids and industrial manufacturing environments. A security flaw in its underlying encryption component could allow a remote attacker to decrypt sensitive communication between the device and other systems. While the attack requires a large number of messages to succeed, it could ultimately lead to the exposure of confidential operational data.

Technologies: [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Hitachi Energy](https://junglewise.ai/threats/vendors/hitachi-energy).

## Quick answers

**Is CVE-2022-4304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-4304 being exploited in the wild.

**How severe is CVE-2022-4304?** High severity, with a CVSS score of 3.1, published 7 February 2023.

**Which products and versions are affected?** openssl-src (crates.io) SEMVER:introduced=0,fixed=111.25.0, SEMVER:introduced=0.0.0-0,fixed=111.25.0,introduced=300.0.0,fixed=300.0.12; Hitachi Energy GMS600 1.3.0, 1.3.1.

**Is there a fix for CVE-2022-4304?** Yes. openssl-src (crates.io): upgrade to 111.25.0, 300.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-4304 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2022-4304?** Check whether you run openssl-src (crates.io) or Hitachi Energy GMS600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openssl-src (crates.io): upgrade to 111.25.0, 300.0.12 or later

  ```sh
  cargo update -p openssl-src
  ```


## Technical details

A timing-based side-channel vulnerability (Bleichenbacher-style attack) exists in the OpenSSL RSA decryption implementation used by Hitachi Energy GMS600. The flaw, tracked as CVE-2022-4304, stems from an observable discrepancy (CWE-203) in the time taken to process RSA decryption trial messages across various padding modes (PKCS#1 v1.5, RSA-OAEP, and RSASVE). A network-based attacker who has captured a genuine TLS handshake can send a large volume of specially crafted messages to the server to observe processing times. By analyzing these discrepancies, the attacker can eventually recover the pre-master secret and decrypt the session's application data. The vulnerability is addressed in GMS600 version 1.3.2.

## Affected products

- Hitachi Energy GMS600 1.3.0, 1.3.1

## Identifiers

- CVE-2022-4304
- GHSA-p52g-cm5j-mjv4
- RUSTSEC-2023-0007

## Timeline

- 2023-06-27: disclosed: Initial public release by Hitachi Energy
- 2026-04-28: patched: Updated fixed version information provided
- 2026-05-21: advisory: CISA republication of the advisory

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-01)

## Related threats

- [RUSTSEC-2023-0009 - Use-after-free following `BIO_new_NDEF`](https://junglewise.ai/threats/cve-2023-0215-openssl-src-vulnerable-to-use-after-free-following-bio-new-ndef)
- [RUSTSEC-2023-0008 - X.509 Name Constraints Read Buffer Overflow](https://junglewise.ai/threats/cve-2022-4203-openssl-src-contains-read-buffer-overflow-in-x-509-name-constraint)
- [RUSTSEC-2023-0006 - X.400 address type confusion in X.509 `GeneralName`](https://junglewise.ai/threats/cve-2023-0286-vulnerable-openssl-included-in-cryptography-wheels)
- [RUSTSEC-2023-0011 - Invalid pointer dereference in `d2i_PKCS7` functions](https://junglewise.ai/threats/cve-2023-0216-openssl-src-subject-to-invalid-pointer-dereference-in-d2i-pkcs7)
- [RUSTSEC-2023-0010 - Double free after calling `PEM_read_bio_ex`](https://junglewise.ai/threats/cve-2022-4450-openssl-src-contains-double-free-after-calling-pem-read-bio-ex)