CVE-2024-26306

Name of the Vulnerable Software and Affected Versions iPerf3 versions prior to 3.17 OpenSSL versions prior to 3.2.0

Description The issue is related to a timing side channel in RSA decryption operations when iPerf3 is used as a server with RSA authentication and OpenSSL. This could allow a remote attacker to recover credential plaintext by sending a large number of messages for decryption, as described in the "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

Recommendations For iPerf3 versions prior to 3.17, update to version 3.17 or later to resolve the issue. For OpenSSL versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider disabling RSA authentication in iPerf3 until a patch is available. Restrict access to the server with RSA authentication to minimize the risk of exploitation.