CVE-2018-5407

4.7

MEDIUMCVSS v3

Published

November 15, 2018

CVSS v2

1.9 LOW

Affected

10 projects

Assigned by

[email protected]

Severity scale

010

Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

openssl/openssl

GitHubGeneral purpose TLS and crypto library

>= 1.0.2, < 1.0.2q, >= 1.1.0, < 1.1.0iNVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

>= 10.0.0, < 10.9.0, >= 8.0.0, < 8.11.4, < 6.14.4NVD

bbbrumley/portsmash

More on this CVE

NVD↗GitHub Advisory↗

GitHub

NVD

ruby/openssl

GitHubProvides SSL, TLS and general purpose cryptography.

>= 1.0.2, < 1.0.2q, >= 1.1.0, < 1.1.0iNVD

openssl

NPMNodejs openssl wrapper

>= 1.0.2, < 1.0.2q, >= 1.1.0, < 1.1.0iNVD

nodejs

Python Package IndexPython bindings and utils for Node.js and io.js

>= 10.0.0, < 10.9.0, >= 8.0.0, < 8.11.4, < 6.14.4NVD

nodejs

NPM

>= 10.0.0, < 10.9.0, >= 8.0.0, < 8.11.4, < 6.14.4NVD

Node.js

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

>= 10.0.0, < 10.9.0, >= 8.0.0, < 8.11.4, < 6.14.4NVD

openssl

Crates.ioOpenSSL bindings

>= 1.0.2, < 1.0.2q, >= 1.1.0, < 1.1.0iNVD

openssl

RubyGemsOpenSSL for Ruby provides access to SSL/TLS and general-purpose cryptography based on the OpenSSL library.

>= 1.0.2, < 1.0.2q, >= 1.1.0, < 1.1.0iNVD

Security Advisories

CVE-2018-5407

Description

More on this CVE