VulnerabilityModified
CVE-2016-2107
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an…
MEDIUM 5.9EPSS 89.1%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 89.1%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 89.06% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-310
- Affected
- redhat/enterprise linux desktop · redhat/enterprise linux hpc node · redhat/enterprise linux hpc node eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server eus · redhat/enterprise linux workstation · opensuse/leap · opensuse/opensuse · openssl/openssl · google/android · hp/helion openstack · nodejs/node.js · debian/debian linux · canonical/ubuntu linux
- Source
- secalert@redhat.com
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.htmlThird Party Advisory, VDB Entry
- http://rhn.redhat.com/errata/RHSA-2016-0722.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0996.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2073.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory
- http://source.android.com/security/bulletin/2016-07-01.htmlThird Party Advisory
- http://support.citrix.com/article/CTX212736Third Party Advisory
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-opensslThird Party Advisory
- http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.htmlThird Party Advisory
- http://www.debian.org/security/2016/dsa-3566Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.