Medium severity · published Jan 22, 2016
CVE-2015-7744
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low…
5.9
CVSS
5.1%
EPSS
No
On KEV
Description
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Leap · Opensuse
42.1 · source: NVD
MA
Mariadb · Mariadb
5.5.0 before 5.5.46; 10.0.0 before 10.0.22; 10.1.0 before 10.1.9 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
WO
Wolfssl · Wolfssl
before 3.6.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7744
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7744
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00015.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00016.html
Release Notes
http://wolfssl.com/wolfSSL/Docs-wolfssl-changelog.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
Broken Link
http://www.securitytracker.com/id/1034708
More from Mariadb
9.9
CVE-2026-85748
MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
9.9
CVE-2026-85746
MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
9.9
CVE-2026-92262
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
9.9
CVE-2026-32710
Heap-based Buffer Overflow in MariaDB
9.8
CVE-2026-44170
MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL