CVE-2017-10668
Last modified
CVE-2017-10668 is a vulnerability of currently unknown severity. A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the transport encryption.. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the transport encryption.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xoev | Osci Transport Library | 1.6 |
| Xoev | Osci Transport Library | 1.6.1 |
References
- http://seclists.org/fulldisclosure/2017/Jun/44Mailing List, Third Party Advisory
- http://blog.sec-consult.com/2017/06/german-e-government-details-vulnerabilities.htmlTechnical Description, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/Jun/44Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-10668?
How severe is CVE-2017-10668?
How do I fix CVE-2017-10668?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-10661Race condition in fs/timerfd.c in the Linux kernel before 4.…7
- CVE-2017-10662The sanity_check_raw_super function in fs/f2fs/super.c in th…7.8
- CVE-2017-10663The sanity_check_ckpt function in fs/f2fs/super.c in the Lin…7.8
- CVE-2017-10664qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIP…7.5
- CVE-2017-10665Directory traversal vulnerability in ajaxfileupload.php in K…
- CVE-2017-10667In index.php in Zen Cart 1.6.0, the products_id parameter ca…
- CVE-2017-10669Signature Wrapping exists in OSCI-Transport 1.2 as used in O…
- CVE-2017-1067Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-10670An XML External Entity (XXE) issue exists in OSCI-Transport …
- CVE-2017-10671Heap-based Buffer Overflow in the de_dotdot function in libh…7.8
- CVE-2017-10672Use-after-free in the XML-LibXML module through 2.0129 for P…9.8
- CVE-2017-10673admin/profile.php in GetSimple CMS 3.x has XSS in a name fie…6.1
Are you affected by CVE-2017-10668?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST