Vulnerability Description
The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.
CVSS Score
7.5
HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xyssl | Xyssl | <= 0.8 |
Related Weaknesses (CWE)
References
- http://polarssl.org/?archive#001c
- http://www.vupen.com/english/advisories/2008/0917/referencesVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41253
- http://polarssl.org/?archive#001c
- http://www.vupen.com/english/advisories/2008/0917/referencesVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41253
FAQ
What is CVE-2008-7128?
CVE-2008-7128 is a vulnerability with a CVSS score of 7.5 (HIGH). The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspec...
How severe is CVE-2008-7128?
CVE-2008-7128 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-7128?
Check the references section above for vendor advisories and patch information. Affected products include: Xyssl Xyssl.