PT-2024-4043 · Openssl+9 · Openssl+9
Hubert Kario
·
Published
2024-05-13
·
Updated
2026-01-21
·
CVE-2024-26306
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
iPerf3 versions prior to 3.17
OpenSSL versions prior to 3.2.0
Description
The issue is related to a timing side channel in RSA decryption operations when iPerf3 is used as a server with RSA authentication and OpenSSL. This could allow a remote attacker to recover credential plaintext by sending a large number of messages for decryption, as described in the "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
Recommendations
For iPerf3 versions prior to 3.17, update to version 3.17 or later to resolve the issue.
For OpenSSL versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue.
As a temporary workaround, consider disabling RSA authentication in iPerf3 until a patch is available.
Restrict access to the server with RSA authentication to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Openssl
Red Hat
Red Os
Rocky Linux
Ubuntu
Iperf3