CVE-2017-17428

Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

Score

CVSS 3.0 5.9 Medium

Status

Modified - cve@mitre.org

Published

2018-03-05

Last modified

2024-08-05

Weaknesses

CWE-327

Affected products

• Nitrox Ssl Sdk (Cavium)
• Nitrox V Ssl Sdk (Cavium)
• Octeon Sdk (Cavium)
• Octeon Ssl Sdk (Cavium)
• Turbossl Sdk (Cavium)
• Ace30 Application Control Engine Module Firmware (Cisco)
• Ace4710 Application Control Engine Firmware (Cisco)
• Adaptive Security Appliance 5505 Firmware (Cisco)
• Adaptive Security Appliance 5510 Firmware (Cisco)
• Adaptive Security Appliance 5520 Firmware (Cisco)
• Adaptive Security Appliance 5540 Firmware (Cisco)
• Adaptive Security Appliance 5550 Firmware (Cisco)
• Webex Conect Im (Cisco)
• Webex Meetings (Cisco)

References

• http://www.securityfocus.com/bid/102170
• http://www.securitytracker.com/id/1039984
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher
• https://www.cavium.com/security-advisory-cve-2017-17428.html
• https://www.kb.cert.org/vuls/id/144389