{"id":"DEBIAN-CVE-2024-26306","details":"iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in \"Everlasting ROBOT: the Marvin Attack\" by Hubert Kario.","modified":"2026-09-15T09:02:55.822858597Z","published":"2024-05-14T15:08:51.197Z","upstream":["CVE-2024-26306"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-26306"}],"affected":[{"package":{"name":"iperf3","ecosystem":"Debian:12","purl":"pkg:deb/debian/iperf3?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12-1","3.12-1+deb12u1","3.12-1+deb12u2","3.13-1","3.13-2","3.14-1","3.15-1","3.16-1","3.17.1-1","3.18-1","3.18-2","3.19.1-1","3.19.1-2","3.20-1","3.20-2","3.20-2.1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26306.json"}},{"package":{"name":"iperf3","ecosystem":"Debian:13","purl":"pkg:deb/debian/iperf3?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26306.json"}},{"package":{"name":"iperf3","ecosystem":"Debian:14","purl":"pkg:deb/debian/iperf3?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26306.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}