CVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 95.7%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 95.71% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- redhat/jboss enterprise application platform · redhat/jboss enterprise web server · redhat/jboss web server · redhat/enterprise linux · python/python · cisco/content security management appliance · openssl/openssl · oracle/database · nodejs/node.js
- Source
- secalert@redhat.com
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.htmlThird Party Advisory, VDB Entry
- http://rhn.redhat.com/errata/RHSA-2017-0336.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0337.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0338.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0462.htmlThird Party Advisory
- http://seclists.org/fulldisclosure/2017/Jul/31Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/May/105Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/May/105Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/May/105Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/May/105Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.