VULNERABILITY INTELLIGENCE

CVE-2017-10668

CVSS score5.9 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2017-06-30

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the transport encryption.

Weakness classification

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Primary references

cve@mitre.org — Mailing List, Third Party Advisory
nvd@nist.gov — Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory