Aller au contenu
en Se connecter
7.5 Élevée

CVE-2024-41996 Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is…

Description

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.

Produits et versions touchés

Produit Versions touchées Corrigé en
n/a Versions non publiées
diffie-hellman_key_exchange Versions non publiées
RUGGEDCOM RST2428P 3.3 premières → < 3.3 3.3
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family 3.3 premières → < 3.3 3.3
SCALANCE XCH328 3.3 premières → < 3.3 3.3
SCALANCE XCM324 3.3 premières → < 3.3 3.3
SCALANCE XCM328 3.3 premières → < 3.3 3.3
SCALANCE XCM332 3.3 premières → < 3.3 3.3
SCALANCE XRH334 (24 V DC, 8xFO, CC) 3.3 premières → < 3.3 3.3
Afficher les 11 autres branches
Produit Versions touchées Corrigé en
SCALANCE XRM334 (230 V AC, 12xFO) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (230 V AC, 8xFO) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (24 V DC, 12xFO) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (24 V DC, 8xFO) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (2x230 V AC, 12xFO) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (2x230 V AC, 8xFO) 3.3 premières → < 3.3 3.3
SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) 3.3 premières → < 3.3 3.3
SIDIS Prime 4.0 premières → < 4.0.800 4.0.800
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1 premières → < 1.1.1 1.1.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de n/a

Les 144658 CVE de n/a →
CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the… Non notée CVE-2026-106715 NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin… Non notée CVE-2026-106714 Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it… Non notée CVE-2026-106716 ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep… Non notée
Suivre cette CVE