CVE-2016-7438 — Wolfssl vulnerability

CWE-3104 documents4 sources

Severity

5.5MEDIUMNVD

EPSS

0.1%

top 67.70%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wolfssl Debian Wolfssl

Timeline

PublishedDec 13

Latest updateMay 17

Description

The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/wolfssl< wolfssl 3.9.10+dfsg-1 (bookworm)

▶Debianwolfssl/wolfssl< 3.9.10+dfsg-1+3

▶NVDwolfssl/wolfssl3.9.8

🔴Vulnerability Details

GHSA

GHSA-mx7m-rr36-mf2q: The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3↗2022-05-17

▶

OSV

CVE-2016-7438: The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3↗2016-12-13

▶

📋Vendor Advisories

Debian

CVE-2016-7438: wolfssl - The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 ...↗2016

▶