Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
CVE-2016-2107
CVE information
Published
Last Modified
CVSSv2.0 Severity
CVSSv3.1 Severity
Impact Analysis
Description
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169..
CVSSv2.0 Score
- Severity
- Low
- Base Score
- 2.6/10
- Exploit Score
- 4.9/10
- Access Vector
- Network
- Access Complexity
- High
- Authentication Required
- None
- Impact Score
- 2.9/10
- Confidentiality Impact
- Partial
- Availability Impact
- None
- Integrity Impact
- None
CVSSv3.1 Score
- Severity
- Medium
- Base Score
- 5.9/10
- Exploit Score
- 2.2/10
- Access Vector
- Network
- Access Complexity
- High
- Privileges Required
- None
- Impact Score
- 3.6/10
- Confidentiality Impact
- High
- Availability Impact
- None
- Integrity Impact
- None
- Scope
- Unchanged
- User Interaction
- None
Products Affected
| CPE | Affected | Vulnerable | Excluding | Edit |
|---|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*: |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:hp:helion_openstack:2.1.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:hp:helion_openstack:2.1.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:hp:helion_openstack:2.1.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:hp:helion_openstack:2.0.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*: |
Yes
|
- | - | |
| cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
Yes
|
4.0.0 | - | |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
Yes
|
0.12.0 | 0.12.14 | |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
Yes
|
0.10.0 | 0.10.45 | |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
Yes
|
4.2.0 | 4.4.4 | |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
Yes
|
5.0.0 | 5.11.1 | |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* |
Yes
|
- | - |
References
- https://www.openssl.org/news/secadv/20160503.txt
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
- https://kc.mcafee.com/corporate/index?page=content&id=SB10160
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
- http://source.android.com/security/bulletin/2016-07-01.html
- http://rhn.redhat.com/errata/RHSA-2016-0722.html
- http://rhn.redhat.com/errata/RHSA-2016-0996.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- https://support.apple.com/HT206903
- http://www.securityfocus.com/bid/91787
- https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- http://www.securityfocus.com/bid/89760
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
- http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html
- https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc
- https://www.exploit-db.com/exploits/39768/
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
- http://www.ubuntu.com/usn/USN-2959-1
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-sec
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
- http://www.securitytracker.com/id/1035721
- http://www.debian.org/security/2016/dsa-3566
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-o
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
- https://bto.bluecoat.com/security-advisory/sa123
- http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.
- http://support.citrix.com/article/CTX212736
- https://security.gentoo.org/glsa/201612-16
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://www.tenable.com/security/tns-2016-18
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://security.netapp.com/advisory/ntap-20160504-0001/
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://rhn.redhat.com/errata/RHSA-2016-2073.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=68595c0c2886e7942a14f98c17a55a88af