CVE-2016-6882

Опубликовано: 03 мар. 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack.

Ссылки

http://www.openwall.com/lists/oss-security/2016/08/19/7
Mailing List
Patch
http://www.securityfocus.com/bid/91488
https://access.redhat.com/blogs/766093/posts/1976703
Third Party Advisory
https://github.com/matrixssl/matrixssl/blob/master/CHANGES.md#validation-of-rsa-signature-creation
Patch
Release Notes
https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf
Technical Description
http://www.openwall.com/lists/oss-security/2016/08/19/7
Mailing List
Patch
http://www.securityfocus.com/bid/91488
https://access.redhat.com/blogs/766093/posts/1976703
Third Party Advisory
https://github.com/matrixssl/matrixssl/blob/master/CHANGES.md#validation-of-rsa-signature-creation
Patch
Release Notes
https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf
Technical Description

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:matrixssl:matrixssl:*:*:*:*:*:*:*:*

Версия до 3.8.6 (включая)

EPSS

Процентиль: 69%

0.01302

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2016-6882

CVSS3: 5.9

ubuntu

больше 9 лет назад

MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack.

CVE-2016-6882

CVSS3: 5.9

debian

больше 9 лет назад

MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is support ...

GHSA-hwgf-8qg9-7wv3

CVSS3: 5.9

github

больше 4 лет назад

MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack.

EPSS

Процентиль: 69%

0.01302

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200