CVE-2024-26306

A timing-based side-channel flaw was found in iperf3. If the iperf3 server is running with the --rsa-private-key-path option, the user authentication API can be attacked.

The timing-based side-channel flaw in iperf3's handling of the --rsa-private-key-path option represents a moderate severity issue due to its potential impact on the confidentiality and integrity of user authentication. While the vulnerability allows for the exploitation of timing discrepancies to potentially deduce information about the private key, it requires specific conditions to be met for successful exploitation. Additionally, the attack vector is limited to instances where the server is configured with the --rsa-private-key-path option and actively engaged in user authentication. While the risk is significant for servers using this configuration, the broader impact is mitigated by these constraints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.