CVE-2017-17428

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/102170Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039984Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacherThird Party Advisory
https://www.cavium.com/security-advisory-cve-2017-17428.htmlVendor Advisory
https://www.kb.cert.org/vuls/id/144389Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/102170Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039984Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacherThird Party Advisory
https://www.cavium.com/security-advisory-cve-2017-17428.htmlVendor Advisory
https://www.kb.cert.org/vuls/id/144389Third Party Advisory, US Government Resource

Timeline

Published: Mar 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-174295.5In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with CVE-2017-17434.3IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper han CVE-2017-174309.8Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface.CVE-2017-174316.1GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761 CVE-2017-174327.5OpenAFS 1.x before 1.6.22 does not properly validate Rx ack packets, which allows remote attackers to cause a denial of service (system cras CVE-2017-174333.7The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file meta CVE-2017-174349.8The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data str CVE-2017-174358.8An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this CVE-2017-174368.8An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android applic CVE-2017-174397.5In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fie CVE-2017-174406.5GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF CVE-2017-174426.1In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker