« Volver al listado

CVE-2008-7128

Estado: ModificadaAlta (7.5)—

The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Xyssl — Xyssl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-7128",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-31T10:30:01.217",
  "references": [
    {
      "url": "http://polarssl.org/?archive#001c",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0917/references",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41253",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://polarssl.org/?archive#001c",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0917/references",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41253",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "La función ssl_parse_client_key_exchange de XySSL anterior a v0.9, no protege de determinados ataques Bleichenbacher que utilicen determinado texto cifrado, esto permite a atacantes remotos recuperar las claves a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-16T23:03:40.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E54F52B-1D44-45CE-A4FB-4084E52FCAD7",
              "versionEndIncluding": "0.8"
            },
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FF85863-AE04-4B1E-87AA-5D32B3D28A51"
            },
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE0643D9-E251-4EC7-BC24-BBCA5BA6CD8C"
            },
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4018A22E-F8C7-4A2E-BBC7-1A360BEEC868"
            },
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21128DCE-2FEA-4038-9FA3-167C1BA9B041"
            },
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DFD8E9D-3CAF-4BC6-B5F2-5DE27A53E8C7"
            },
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4116FDA1-E82E-436F-9E5A-80CBB5512EE5"
            },
            {
              "criteria": "cpe:2.3:a:xyssl:xyssl:0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "232BBEA4-E2B6-4667-AD6D-DECF21647316"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}