iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in Everlasting ROBOT: the Marvin Attack by Hubert Kario.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | RedHat | iperf3-0:3.5-10.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | iperf3-0:3.9-13.el9 | * |
| Iperf3 | Ubuntu | mantic | * |