CVE-2016-2107
- Source
- https://cve.org/CVERecord?id=CVE-2016-2107
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2107.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2016-2107
- Downstream
- Related
- Published
- 2016-05-05T01:59:03.200Z
- Modified
- 2026-07-08T05:49:08.026634155Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "introduced": "12.04" }, { "last_affected": "12.04" }, { "introduced": "14.04" }, { "last_affected": "14.04" }, { "introduced": "15.10" }, { "last_affected": "15.10" }, { "introduced": "16.04" }, { "last_affected": "16.04" } ], "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*" ], "source": "CPE_STRING", "vendor_product": "canonical:ubuntu_linux" }, { "extracted_events": [ { "introduced": "8.0" }, { "last_affected": "8.0" } ], "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "debian:debian_linux" }, { "extracted_events": [ { "introduced": "4.0" }, { "last_affected": "4.0" }, { "introduced": "4.0.1" }, { "last_affected": "4.0.1" }, { "introduced": "4.0.2" }, { "last_affected": "4.0.2" }, { "introduced": "4.0.3" }, { "last_affected": "4.0.3" }, { "introduced": "4.0.4" }, { "last_affected": "4.0.4" }, { "introduced": "4.1" }, { "last_affected": "4.1" }, { "introduced": "4.1.2" }, { "last_affected": "4.1.2" }, { "introduced": "4.2" }, { "last_affected": "4.2" }, { "introduced": "4.2.1" }, { "last_affected": "4.2.1" }, { "introduced": "4.2.2" }, { "last_affected": "4.2.2" }, { "introduced": "4.3" }, { "last_affected": "4.3" }, { "introduced": "4.3.1" }, { "last_affected": "4.3.1" }, { "introduced": "4.4" }, { "last_affected": "4.4" }, { "introduced": "4.4.1" }, { "last_affected": "4.4.1" }, { "introduced": "4.4.2" }, { "last_affected": "4.4.2" }, { "introduced": "4.4.3" }, { "last_affected": "4.4.3" }, { "introduced": "5.0" }, { "last_affected": "5.0" }, { "introduced": "5.0.1" }, { "last_affected": "5.0.1" }, { "introduced": "5.1" }, { "last_affected": "5.1" }, { "introduced": "5.1.0" }, { "last_affected": "5.1.0" } ], "cpes": [ "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*", "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "google:android" }, { "extracted_events": [ { "introduced": "2.0.0" }, { "last_affected": "2.0.0" }, { "introduced": "2.1.0" }, { "last_affected": "2.1.0" }, { "introduced": "2.1.2" }, { "last_affected": "2.1.2" }, { "introduced": "2.1.4" }, { "last_affected": "2.1.4" } ], "cpes": [ "cpe:2.3:a:hp:helion_openstack:2.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:hp:helion_openstack:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:hp:helion_openstack:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:hp:helion_openstack:2.1.4:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "hp:helion_openstack" }, { "extracted_events": [ { "introduced": "42.1" }, { "last_affected": "42.1" } ], "cpes": [ "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "opensuse:leap" }, { "extracted_events": [ { "introduced": "13.2" }, { "last_affected": "13.2" } ], "cpes": [ "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "opensuse:opensuse" }, { "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" }, { "introduced": "6.0" }, { "last_affected": "6.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_desktop" }, { "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" }, { "introduced": "6.0" }, { "last_affected": "6.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_hpc_node" }, { "extracted_events": [ { "introduced": "7.2" }, { "last_affected": "7.2" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_hpc_node_eus" }, { "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" }, { "introduced": "6.0" }, { "last_affected": "6.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server" }, { "extracted_events": [ { "introduced": "7.2" }, { "last_affected": "7.2" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_aus" }, { "extracted_events": [ { "introduced": "7.2" }, { "last_affected": "7.2" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_eus" }, { "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" }, { "introduced": "6.0" }, { "last_affected": "6.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_workstation" } ] }- References
-
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=68595c0c2886e7942a14f98c17a55a88afb6c292
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html
- http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
- http://rhn.redhat.com/errata/RHSA-2016-0722.html
- http://rhn.redhat.com/errata/RHSA-2016-0996.html
- http://rhn.redhat.com/errata/RHSA-2016-2073.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://source.android.com/security/bulletin/2016-07-01.html
- http://support.citrix.com/article/CTX212736
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
- http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html
- http://www.debian.org/security/2016/dsa-3566
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/89760
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1035721
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103
- http://www.ubuntu.com/usn/USN-2959-1
- https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03728en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
- https://kc.mcafee.com/corporate/index?page=content&id=SB10160
- https://security.gentoo.org/glsa/201612-16
- https://security.netapp.com/advisory/ntap-20160504-0001/
- https://support.apple.com/HT206903
- https://www.exploit-db.com/exploits/39768/
- https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc
- https://www.openssl.org/news/secadv/20160503.txt
- https://www.tenable.com/security/tns-2016-18
- https://bto.bluecoat.com/security-advisory/sa123
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Affected packages
Git / github.com/nodejs/node
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast affectedIntroducedFixedIntroducedFixedIntroducedLast affected
- Database specific
{ "extracted_events": [ { "introduced": "0.10.0" }, { "fixed": "0.10.45" }, { "introduced": "0.12.0" }, { "fixed": "0.12.14" }, { "introduced": "4.0.0" }, { "last_affected": "4.1.2" }, { "introduced": "4.2.0" }, { "fixed": "4.4.4" }, { "introduced": "5.0.0" }, { "fixed": "5.11.1" }, { "introduced": "6.0.0" }, { "last_affected": "6.0.0" } ], "cpe": [ "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*", "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:*:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING" ] }
Git / github.com/openssl/openssl
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "0" }, { "last_affected": "1.0.1s" }, { "introduced": "1.0.2" }, { "last_affected": "1.0.2" }, { "introduced": "1.0.2a" }, { "last_affected": "1.0.2a" }, { "introduced": "1.0.2b" }, { "last_affected": "1.0.2b" }, { "introduced": "1.0.2c" }, { "last_affected": "1.0.2c" }, { "introduced": "1.0.2d" }, { "last_affected": "1.0.2d" }, { "introduced": "1.0.2e" }, { "last_affected": "1.0.2e" }, { "introduced": "1.0.2f" }, { "last_affected": "1.0.2f" }, { "introduced": "1.0.2g" }, { "last_affected": "1.0.2g" }, { "introduced": "1.0.2-beta1" }, { "last_affected": "1.0.2-beta1" }, { "introduced": "1.0.2-beta2" }, { "last_affected": "1.0.2-beta2" }, { "introduced": "1.0.2-beta3" }, { "last_affected": "1.0.2-beta3" } ], "source": [ "CPE_RANGE", "CPE_STRING" ] }
Affected versions
1.*
1.0.2
1.0.2-beta1
1.0.2-beta2
1.0.2-beta3
Other
OpenSSL_1_0_1
OpenSSL_1_0_1-beta1
OpenSSL_1_0_1-beta2
OpenSSL_1_0_1-beta3
OpenSSL_1_0_1-post-auto-reformat
OpenSSL_1_0_1-post-reformat
OpenSSL_1_0_1-pre-auto-reformat
OpenSSL_1_0_1-pre-reformat
OpenSSL_1_0_1a
OpenSSL_1_0_1b
OpenSSL_1_0_1c
OpenSSL_1_0_1d
OpenSSL_1_0_1e
OpenSSL_1_0_1f
OpenSSL_1_0_1g
OpenSSL_1_0_1h
OpenSSL_1_0_1i
OpenSSL_1_0_1j
OpenSSL_1_0_1k
OpenSSL_1_0_1l
OpenSSL_1_0_1m
OpenSSL_1_0_1n
OpenSSL_1_0_1o
OpenSSL_1_0_1p
OpenSSL_1_0_1q
OpenSSL_1_0_1r
OpenSSL_1_0_1s
OpenSSL_1_0_1t
OpenSSL_1_0_1u
OpenSSL_1_0_2-beta1
OpenSSL_1_0_2-beta2
OpenSSL_1_0_2-beta3