A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Se encontró una falla en m2crypto. Este problema puede permitir que un atacante remoto descifre mensajes capturados en servidores TLS que utilizan intercambios de claves RSA, lo que puede provocar la exposición de datos confidenciales o sensibles.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-203
|
| [email protected] | Secondary |
en
CWE-203
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd386708d80> | Operating System |
| redhat | enterprise_linux | 9.0 | <built-in method update of dict object at 0x7fd36b8f4a40> | Operating System |
| redhat | update_infrastructure | 4 | <built-in method update of dict object at 0x7fd36be7ab80> | Application |
| m2crypto_project | m2crypto | * | <built-in method update of dict object at 0x7fd2dbc8c9c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:update_infrastructure:4:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:m2crypto_project:m2crypto:*:*:*:*:*:*:*:* |