CVE-2024-26306
Fixed in a distro release EPSS 1%CVSS 5.9
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
Products: es iperf3, netapp bootstrap_os
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | iperf3 | 3.5-10.el8_10 |
| AlmaLinux 9 | iperf3 | 3.9-13.el9 |
| Debian 11 | iperf3 | 3.9-1+deb11u2 |
| Debian 12 | iperf3 | no fix |
| Debian 13 | iperf3 | 3.17.1-1 |
| Debian 14 | iperf3 | 3.17.1-1 |
| Red Hat Enterprise Linux 8 | iperf3 | 0:3.5-10.el8_10 |
| Red Hat Enterprise Linux 8 | iperf3-debuginfo | 0:3.5-10.el8_10 |
| Red Hat Enterprise Linux 8 | iperf3-debugsource | 0:3.5-10.el8_10 |
| Red Hat Enterprise Linux 9 | iperf3 | 0:3.9-13.el9 |
| Red Hat Enterprise Linux 9 | iperf3-debuginfo | 0:3.9-13.el9 |
| Red Hat Enterprise Linux 9 | iperf3-debugsource | 0:3.9-13.el9 |
| Rocky Linux 8 | iperf3 | 0:3.5-10.el8_10 |
| Rocky Linux 9 | iperf3 | 0:3.9-13.el9_5.1 |
| SUSE Enterprise Storage 7.1 | iperf | 3.17.1-150000.3.9.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | iperf | 3.17.1-150000.3.9.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | iperf | 3.17.1-150000.3.9.1 |
| Ubuntu 22.04 LTS | iperf3 | 3.9-1+deb11u1ubuntu0.1 |
| Ubuntu 25.10 | iperf3 | 3.18-2ubuntu0.1 |
| Ubuntu Pro 16.04 LTS | iperf3 | no fix |
| Ubuntu Pro 18.04 LTS | iperf3 | no fix |
| Ubuntu Pro 20.04 LTS | iperf3 | 3.7-3ubuntu0.1~esm2 |
| Ubuntu Pro 24.04 LTS | iperf3 | 3.16-1ubuntu0.1~esm1 |
| openSUSE Leap 15.5 | iperf | 3.17.1-150000.3.9.1 |
| openSUSE Leap 15.6 | iperf | 3.17.1-150000.3.9.1 |