CVE-2024-26306
MEDIUMDescription
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
Is your site exposed to CVE-2024-26306?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| es | iperf3 |
| netapp | bootstrap_os |
| netapp | hci_compute_node |
References
Other References
Frequently Asked Questions
What is CVE-2024-26306? +
How severe is CVE-2024-26306? +
What products are affected by CVE-2024-26306? +
How do I check if I'm vulnerable to CVE-2024-26306? +
Related Vulnerabilities
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) …
Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 …
Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key …
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, …
vLLM is an inference and serving engine for large language models (LLMs). Before version 0.11.0rc2, the API key support in …
A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker …