Inadequate Encryption Strength Affecting wolfSSL/wolfssh package, versions [,5.7.2)
Threat Intelligence
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-WOLFSSLWOLFSSH-7850354
- published 29 Aug 2024
- disclosed 27 Aug 2024
- credit Kemal Derya, M. Caner Tol, Berk Sunar
Introduced: 27 Aug 2024
CVE-2024-5288 Open this link in a new tabHow to fix?
Upgrade wolfSSL/wolfssh to version 5.7.2 or higher.
Overview
Affected versions of this package are vulnerable to Inadequate Encryption Strength via the WOLFSSL_CHECK_SIG_FAULTS setting in server-side TLS connections. An attacker can disclose ECDSA keys by exploiting the Rowhammer attack technique, specifically through the FAULT+PROBE method.