CVE-2017-13099 — Observable Discrepancy in Wolfssl

CWE-203 — Observable Discrepancy7 documents5 sources
Severity
5.9MEDIUMNVD
CNA7.5
EPSS
78.7%
top 0.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
WolfsslArubanetworks InstantSiemens Scalance W1750d Firmware
Timeline
PublishedDec 13
Latest updateMay 13

Description

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages5 packages

▶NVDwolfssl/wolfssl< 3.12.2
▶Debianwolfssl/wolfssl< 3.13.0+dfsg-1+3
▶CVEListV5wolfssl/wolfssl<3.12.2
▶NVDarubanetworks/instant< 6.5.4.6

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-97gp-82pc-qc6x: wolfSSL prior to version 3↗2022-05-13
▶
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities↗2019-04-02
▶
OSV
linux-lts-xenial, linux-aws vulnerabilities↗2019-04-02
▶
CVEList
wolfSSL Bleichenbacher/ROBOT↗2017-12-13
▶
OSV
CVE-2017-13099: wolfSSL prior to version 3↗2017-12-13
▶

📋Vendor Advisories

1
Debian
CVE-2017-13099: wolfssl - wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any T...↗2017
▶
CVE-2017-13099 — Observable Discrepancy in Wolfssl | cvebase