Описание
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| wolfssl | fixed | 3.9.10+dfsg-1 | package | |
| mysql-5.6 | fixed | 5.6.27-1 | package | |
| mysql-5.5 | fixed | 5.5.46-0+deb8u1 | package | |
| mysql-5.5 | fixed | 5.5.46-0+deb8u1 | jessie | package |
| mysql-5.5 | fixed | 5.5.46-0+deb7u1 | wheezy | package |
| mysql-5.5 | fixed | 5.5.46-0+deb6u1 | squeeze | package |
| mariadb-10.0 | fixed | 10.0.22-1 | package | |
| mariadb-10.0 | fixed | 10.0.22-0+deb8u1 | jessie | package |
Примечания
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
EPSS
Связанные уязвимости
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
Уязвимость системы управления базами данных MySQL, позволяющая нарушителю получить доступ на чтение данных
EPSS