Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

MatrixSSL (GUARD TLS-TK) Side-Channel Attack Vulnerability

Information

Severity

Severity

Low

Family

Family

SSL and TLS

CVSSv2 Base

CVSSv2 Base

1.9

CVSSv2 Vector

CVSSv2 Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Solution Type

Solution Type

Vendor Patch

Created

Created

5 years ago

Modified

Modified

5 years ago

Summary

GUARD TLS-TK (formerly MatrixSSL) is vulnerable to a Memory-Cache Side-Channel attack.

Insight

Insight

The flaw is located in the code that computes signature component 's'. In many libraries, the code that performs modular addition does not run in constant time, and so a side channel can recover information that can be used to calculate the private key.

Affected Software

Affected Software

MatrixSSL through version 3.9.5.

Detection Method

Detection Method

Checks if a vulnerable version is present on the target host.

Solution

Solution

Update to version 3.9.6 once released. Contact the vendor at support@matrixssl.org to get a fix until then.

Common Vulnerabilities and Exposures (CVE)