Threats affecting pkg:github/openssl/openssl

CVE-2024-4603 is a vulnerability in OpenSSL 3.0 and 3.1 FIPS providers where unchecked input for loop conditions in DSA key parameter checks can cause excessive processing delays. Applications that call EVP_PKEY_param_check() or EVP_PKEY_public_check() with untrusted DSA keys or parameters may be vulnerable to denial of service due to long computation times on very large modulus values. The OpenSSL SSL/TLS implementation itself is not affected. The vulnerability also affects the OpenSSL pkey and pkeyparam command line tools when used with the -check option.

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.