MEDIUM 5.9 Microsoft

CVE-2024-26306

iPerf3 before 3.17 when used with OpenSSL before 3.2.0 as a server with RSA authentication allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

Microsoft Security Update 2024-May: iPerf3 before 3.17 when used with OpenSSL before 3.2.0 as a server with RSA authentication allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

Affected Products

References

Published: 2024-05-14 · Source: Microsoft · Feed updated: 2026-08-04
This medium severity vulnerability with a CVSS score of 5.9 was published on 2024-05-14 via Microsoft. Affected: cbl2 iperf3 3.17-1 on CBL Mariner 2.0, azl3 iperf3 3.17.1-1 on Azure Linux 3.0, azl3 iperf3 3.16-1 on Azure Linux 3.0 and 1 more.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.