-------------------------------------------------------------------------
Debian LTS Advisory DLA-4032-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Markus Koschany
January 28, 2025                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : iperf3
Version        : 3.9-1+deb11u2
CVE ID         : CVE-2023-7250 CVE-2024-26306 CVE-2024-53580
Debian Bug     : 1071751 1090931

Several security vulnerabilities have been discovered in iperf3, an internet
protocol bandwidth measuring tool, which may lead to a denial-of-service. When
iperf3 was used as a server with RSA authentication CVE-2024-26306 allowed a
timing side channel attack in RSA decryption operations sufficient for an
attacker to recover credential plaintext.

For Debian 11 bullseye, these problems have been fixed in version
3.9-1+deb11u2.

We recommend that you upgrade your iperf3 packages.

For the detailed security status of iperf3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/iperf3

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS