CVE-2015-7744
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
wolfSSL (anteriormente CyaSSL) en versiones anteriores a 3.6.8 no maneja correctamente fallos asociados con el proceso Chinese Remainder Theorem (CRT) cuando permiten el intercambio de claves efímeras sin optimizaciones de memoria baja en un servidor, lo que hace que sea más fácil para atacantes remotos obtener claves privadas RSA mediante la captura de un apretón de manos TLS, también conocido como un ataque Lenstra.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-10-07 CVE Reserved
- 2016-01-22 CVE Published
- 2023-08-06 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (9)
URL | Tag | Source |
---|---|---|
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html | Third Party Advisory | |
http://www.securitytracker.com/id/1034708 | Broken Link |
URL | Date | SRC |
---|---|---|
https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf | 2024-08-06 | |
https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy | 2024-08-06 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Wolfssl Search vendor "Wolfssl" | Wolfssl Search vendor "Wolfssl" for product "Wolfssl" | < 3.6.8 Search vendor "Wolfssl" for product "Wolfssl" and version " < 3.6.8" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 42.1 Search vendor "Opensuse" for product "Leap" and version "42.1" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.1 Search vendor "Opensuse" for product "Opensuse" and version "13.1" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.2 Search vendor "Opensuse" for product "Opensuse" and version "13.2" | - |
Affected
| ||||||
Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 5.5.0 < 5.5.46 Search vendor "Mariadb" for product "Mariadb" and version " >= 5.5.0 < 5.5.46" | - |
Affected
| ||||||
Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.0.0 < 10.0.22 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.0.0 < 10.0.22" | - |
Affected
| ||||||
Mariadb Search vendor "Mariadb" | Mariadb Search vendor "Mariadb" for product "Mariadb" | >= 10.1.0 < 10.1.9 Search vendor "Mariadb" for product "Mariadb" and version " >= 10.1.0 < 10.1.9" | - |
Affected
|