CVE-2015-7744: Medium severity wolfssl wolfmqtt vulnerability
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7744?
CVE-2015-7744 is classified as a high severity vulnerability as it can lead to the exposure of private RSA keys.
How do I fix CVE-2015-7744?
To fix CVE-2015-7744, update wolfSSL to version 3.6.8 or higher to ensure proper handling of CRT faults.
Which versions of wolfSSL are affected by CVE-2015-7744?
Versions of wolfSSL prior to 3.6.8 are affected by CVE-2015-7744.
What types of software are vulnerable to CVE-2015-7744?
CVE-2015-7744 affects wolfSSL, various versions of MariaDB, and certain versions of openSUSE.
Can CVE-2015-7744 be exploited remotely?
Yes, CVE-2015-7744 can be exploited remotely by attackers to capture private RSA keys during TLS sessions.