Skip to content
OpenAdvisories
Unscored CVE-2020-15309 EUVD-2020-7306GHSA-hrmr-g9x6-f5v8

An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack a…

Published Aug 21, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Description

An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive information if the affected system has been used for private key operations (e.g., signing with a private key).

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 wolfssl 4.5.0+dfsg-1 —
Debian 12 wolfssl 4.5.0+dfsg-1 —
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS wolfssl No fix yet —
Ubuntu 18.04 LTS wolfssl No fix yet —
Ubuntu 16.04 LTS wolfssl No fix yet —

References