CVE-2016-2178

Published: Jun 20, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

Affected (45)

Products: Openssl: Openssl · Oracle: Linux, Solaris · Suse: Linux Enterprise · +3 more

Show all products

Openssl: Openssl · Oracle: Linux, Solaris · Suse: Linux Enterprise · Nodejs: Node.js · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

2 products

1 product

1 product

1 product

1 product

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j
Openssl Openssl	Version 1.0.1k
Openssl Openssl	Version 1.0.1l
Openssl Openssl	Version 1.0.1m
Openssl Openssl	Version 1.0.1n
Openssl Openssl	Version 1.0.1o
Openssl Openssl	Version 1.0.1p
Openssl Openssl	Version 1.0.1q
Openssl Openssl	Version 1.0.1r
Openssl Openssl	Version 1.0.1s
Openssl Openssl	Version 1.0.1t
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f
Openssl Openssl	Version 1.0.2g
Openssl Openssl	Version 1.0.2h

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Linux	Version 5
Oracle Linux	Version 6
Oracle Linux	Version 7
Oracle Solaris	Version 10
Oracle Solaris	Version 11.3

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise	Version 12.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 0.10.0 to 0.10.47
Nodejs Node.js	From 0.12.0 to 0.12.16
Nodejs Node.js	From 4.0.0 to 4.1.2
Nodejs Node.js	From 5.0.0 to 6.7.0
Nodejs Node.js	From 4.2.0 to 4.6.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04

Related CWEs

CWE-203

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (138)

http://eprint.iacr.org/2016/594.pdf

Source: secalert@redhat.com

Technical DescriptionThird Party Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1940.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-1659.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/fulldisclosure/2017/Jul/31

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl

Source: secalert@redhat.com

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3673

Source: secalert@redhat.com

Third Party Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/10

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/11

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/12

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/2

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/4

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/5

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/6

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/7

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/08/8

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/09/2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/09/8

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/91081

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1036054

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.splunk.com/view/SP-CAAAPSV

Source: secalert@redhat.com

Third Party Advisory

http://www.splunk.com/view/SP-CAAAPUE

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-3087-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-3087-2

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:0193

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:0194

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1658

Source: secalert@redhat.com

Third Party Advisory

https://bto.bluecoat.com/security-advisory/sa132

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1343400

Source: secalert@redhat.com

Issue TrackingPatch

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Source: secalert@redhat.com

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448

Source: secalert@redhat.com

Third Party Advisory

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

Source: secalert@redhat.com

Third Party Advisory

https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

Source: secalert@redhat.com

Third Party Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

Source: secalert@redhat.com

Third Party Advisory

https://security.gentoo.org/glsa/201612-16

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://support.f5.com/csp/article/K53084033

Source: secalert@redhat.com

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us

Source: secalert@redhat.com

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us

Source: secalert@redhat.com

Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-16

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-20

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-21

Source: secalert@redhat.com

Third Party Advisory

http://eprint.iacr.org/2016/594.pdf