| Name | CVE-2015-5738 |
| Description | The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| openssl (PTS) | jessie, jessie (lts) | 1.0.1t-1+deb8u21 | fixed |
| stretch (security) | 1.1.0l-1~deb9u6 | fixed | |
| stretch (lts), stretch | 1.1.0l-1~deb9u9 | fixed | |
| buster (security), buster, buster (lts) | 1.1.1n-0+deb10u6 | fixed | |
| bullseye | 1.1.1w-0+deb11u1 | fixed | |
| bullseye (security) | 1.1.1w-0+deb11u2 | fixed | |
| bookworm | 3.0.15-1~deb12u1 | fixed | |
| bookworm (security) | 3.0.14-1~deb12u2 | fixed | |
| sid, trixie | 3.3.2-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| openssl | source | (unstable) | (not affected) |
- openssl <not-affected> (OpenSSL upstream is not affected)