CVE-2024-26306
Medium
Description
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
SeverityMedium
CVSS5.9
Exploit probability—
ProductEs Iperf3
PublishedMay 14, 2024
First seenMay 14, 2024
Weakness typeCWE-385CWE-385
How to fix
Update
- es iperf33.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| es iperf3 | v < 3.17 | 3.17 |
| netapp bootstrap_os | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.