Описание
ELSA-2024-9185: iperf3 security update (MODERATE)
[3.9-13]
- Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used
[3.9-12]
- Resolves: RHEL-39975 - possible denial of service
[3.9-11]
- Related: #2223676 - bumping version for correct update path
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
iperf3
3.9-13.el9
Oracle Linux x86_64
iperf3
3.9-13.el9
Связанные CVE
Связанные уязвимости
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.