CVE-2010-0928: Medium severity OpenSSL OpenSSL vulnerability
OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0928?
CVE-2010-0928 is considered a medium severity vulnerability due to the risk it poses from physically proximate attackers.
How do I mitigate CVE-2010-0928?
To mitigate CVE-2010-0928, upgrade OpenSSL to a version that resolves this vulnerability, starting with versions later than 0.9.8i.
What does CVE-2010-0928 affect?
CVE-2010-0928 affects OpenSSL 0.9.8i running on the Gaisler Research LEON3 SoC and Xilinx Virtex-II Pro FPGA.
What type of attack is enabled by CVE-2010-0928?
CVE-2010-0928 enables attacks that could exploit improper signature verification, potentially leading to unauthorized access.
Is CVE-2010-0928 still a concern today?
While CVE-2010-0928 is an older vulnerability, it remains a concern for legacy systems still using OpenSSL 0.9.8i.