CVE-2008-7128 The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspec...
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xyssl | <= 0.8 | No fix listed |
| xyssl | = 0.1 | No fix listed |
| xyssl | = 0.2 | No fix listed |
| xyssl | = 0.3 | No fix listed |
| xyssl | = 0.4 | No fix listed |
| xyssl | = 0.5 | No fix listed |
| xyssl | = 0.6 | No fix listed |
| xyssl | = 0.7 | No fix listed |
References
- polarssl.org
- ADV-2008-0917 vdb-entry vendor-advisory
- xyssl-sslparseclient-security-bypass(41253) vdb-entry