Описание
ELSA-2024-4241: iperf3 security update (MODERATE)
[3.5-10]
- Resolves: RHEL-29578 - vulnerable to marvin attack if the authentication option is used
[3.5-9]
- Resolves: RHEL-17069 - possible denial of service
[3.5-8]
- Related: #2222205 - bumping nvr for correct update path
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
iperf3
3.5-10.el8_10
Oracle Linux x86_64
iperf3
3.5-10.el8_10
Связанные CVE
Связанные уязвимости
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.