CVE-2024-26306: Medium severity redhat/iPerf3 vulnerability
If the iperf3 server is running with --rsa-private-key-path option, the user authentication API can be attacked.
Other sources
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26306?
CVE-2024-26306 has a medium severity rating due to its potential for timing side channel attacks during RSA decryption operations.
How do I fix CVE-2024-26306?
To fix CVE-2024-26306, upgrade iPerf3 to version 3.17 or later.
What software is affected by CVE-2024-26306?
CVE-2024-26306 affects iPerf3 versions prior to 3.17 when using OpenSSL with RSA authentication.
What is the impact of CVE-2024-26306?
The impact of CVE-2024-26306 is that it allows attackers to potentially exploit a side channel vulnerability to retrieve sensitive information.
Is there a recommended mitigation for CVE-2024-26306?
The recommended mitigation for CVE-2024-26306 is to disable the RSA authentication option if upgrading is not immediately possible.