CVE-2016-0701

Published: Feb 15, 2016Modified: May 6, 2026

3.7

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

Affected (9)

Products: Openssl: Openssl

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (48)

http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html

Source: secalert@redhat.com

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

Source: secalert@redhat.com

http://www.openssl.org/news/secadv/20160128.txt

Source: secalert@redhat.com

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/82233

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

http://www.securitytracker.com/id/1034849

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2883-1

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=878e2c5b13010329c203f309ed0c8f2113f85648

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c5b831f21d0d29d1e517d139d9d101763f60c9a2

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201601-05

Source: secalert@redhat.com

https://www.kb.cert.org/vuls/id/257823

Source: secalert@redhat.com

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: secalert@redhat.com

https://www.oracle.com/security-alerts/cpujan2020.html

Source: secalert@redhat.com

https://www.oracle.com/security-alerts/cpujul2020.html

Source: secalert@redhat.com

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert@redhat.com

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: secalert@redhat.com

http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openssl.org/news/secadv/20160128.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/82233

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/91787

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1034849

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2883-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=878e2c5b13010329c203f309ed0c8f2113f85648

Source: af854a3a-2127-422b-91ae-364da2661108

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c5b831f21d0d29d1e517d139d9d101763f60c9a2

Source: af854a3a-2127-422b-91ae-364da2661108

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us

Source: af854a3a-2127-422b-91ae-364da2661108

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821

Source: af854a3a-2127-422b-91ae-364da2661108

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201601-05

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.kb.cert.org/vuls/id/257823

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpujan2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpujul2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.