CVE-2017-17428

MEDIUM

Cavium Nitrox SSL SDK < 6.1.0 - Use of a Broken or Risky Cryptographic Algorithm

Title source: llm

Description

Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

References (5)

Core 5

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102170

Vendor Advisory x_refsource_confirm

https://www.cavium.com/security-advisory-cve-2017-17428.html

Third Party Advisory vendor-advisory x_refsource_cisco

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1039984

Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

https://www.kb.cert.org/vuls/id/144389

Scores

CVSS v3 5.9

EPSS 0.1501

EPSS Percentile 96.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-327

Status published

Products (19)

cavium/nitrox_ssl_sdk < 6.1.0

cavium/nitrox_v_ssl_sdk < 1.2

cavium/octeon_sdk < 1.7.2

cavium/octeon_ssl_sdk < 1.5.0

cavium/turbossl_sdk < 1.0

cisco/ace30_application_control_engine_module_firmware 3.0\(0\)a5\(2.0\)

cisco/ace30_application_control_engine_module_firmware 3.0\(0\)a5\(3.0\)

cisco/ace30_application_control_engine_module_firmware 3.0\(0\)a5\(3.5\)

cisco/ace4710_application_control_engine_firmware 3.0\(0\)a5\(2.0\)

cisco/ace4710_application_control_engine_firmware 3.0\(0\)a5\(3.0\)

... and 9 more

Published Mar 05, 2018

Tracked Since Feb 18, 2026