Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-26306

HistoryMay 14, 2024 - 3:08 p.m.

CVE-2024-26306

2024-05-1415:08:51

Debian Security Bug Tracker

security-tracker.debian.org

iperf3

openssl

rsa

timing side channel

decryption

credential plaintext

everlasting robot

marvin attack

unix

7 High

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in “Everlasting ROBOT: the Marvin Attack” by Hubert Kario.

OSVersionArchitecturePackageVersionFilename
Debian12alliperf3<= 3.12-1+deb12u1iperf3_3.12-1+deb12u1_all.deb
Debian11alliperf3<= 3.9-1+deb11u1iperf3_3.9-1+deb11u1_all.deb
Debian10alliperf3<= 3.6-2iperf3_3.6-2_all.deb
Debian999alliperf3< 3.17.1-1iperf3_3.17.1-1_all.deb
Debian13alliperf3< 3.17.1-1iperf3_3.17.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	iperf3	<= 3.12-1+deb12u1	iperf3_3.12-1+deb12u1_all.deb
Debian	11	all	iperf3	<= 3.9-1+deb11u1	iperf3_3.9-1+deb11u1_all.deb
Debian	10	all	iperf3	<= 3.6-2	iperf3_3.6-2_all.deb
Debian	999	all	iperf3	< 3.17.1-1	iperf3_3.17.1-1_all.deb
Debian	13	all	iperf3	< 3.17.1-1	iperf3_3.17.1-1_all.deb