Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 9 min 160 bronnen 39 vandaag
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2016-2107

MEDIUM · 5.9 CVSS Gepubliceerd: CWE-200

Beschrijving

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

Vendors

Redhat Opensuse Openssl Google Hp Nodejs Debian Canonical

Affected products

Enterprise Linux Desktop Enterprise Linux Hpc Node Enterprise Linux Hpc Node Eus Enterprise Linux Server Enterprise Linux Server Aus Enterprise Linux Server Eus Enterprise Linux Workstation Leap Opensuse Openssl Android Helion Openstack Node.js Debian Linux Ubuntu Linux

References