Add Marvin Attack on rsa crate (#1825)

crates/rsa/RUSTSEC-0000-0000.md

@@ -0,0 +1,27 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "rsa"
+date = "2023-11-22"
+keywords = ["cryptography"]
+categories = ["crypto-failure"]
+url = "https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643"
+references = ["https://people.redhat.com/~hkario/marvin/"]
+
+[versions]
+patched = []
+```
+
+# Marvin Attack: potential key recovery through timing sidechannels
+
+The [Marvin Attack] is a timing sidechannel vulnerability which allows
+performing RSA decryption and signing operations as an attacker with the
+ability to observe only the time of the decryption operation performed with
+the private key.
+
+A recent survey of RSA implementations found that the Rust `rsa` crate is one
+of many implementations vulnerable to this attack.
+
+No fixed version is available at this time.
+
+[Marvin Attack]: https://people.redhat.com/~hkario/marvin/