NVD

Id
28202  
Name
CVE-2015-7744  
Description
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-01-22  
Modified Date
2016-12-07  
Seq
2015-7744  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
148280 28202 CVE-2015-7744 openSUSE-SU-2016:0367  View
148281 28202 CVE-2015-7744 openSUSE-SU-2016:0377  View
148282 28202 CVE-2015-7744 http://wolfssl.com/wolfSSL/Docs-wolfssl-changelog.html  View
148283 28202 CVE-2015-7744 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
148284 28202 CVE-2015-7744 http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html  View
148285 28202 CVE-2015-7744 1034708  View
148286 28202 CVE-2015-7744 https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf  View
148287 28202 CVE-2015-7744 https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/  View
148288 28202 CVE-2015-7744 https://wolfssl.com/wolfSSL/Blog/Entries/2015/9/17_Two_Vulnerabilities_Recently_Found%2C_An_Attack_on_RSA_using_CRT_and_DoS_Vulnerability_With_DTLS.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
302 JVNDB-2016-001075 wolfSSL における RSA 秘密鍵を取得される脆弱性 wolfSSL (旧 CyaSSL) は、サーバ側で Low メモリの最適化なしで短期（ephemeral）鍵交換を許容する場合、Chinese Remainder Theorm (CRT) プロセスに関連した障害を誤って処理するため、RSA 秘密鍵を取得される脆弱性が存在します。 CVE-2015-7744 84969 CVE-2015-7744 28202 2.6 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001075.html 2016-01-19 2016-02-08 View