CVE-2016-2178

MEDIUM

Openssl < 0.10.47 - Information Disclosure

Title source: rule

Description

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

References (69)

[Technical Description, Third Party Advisory] http://eprint.iacr.org/2016/594.pdf

[Third Party Advisory] http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2016-1940.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2016-2957.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2017-1659.html

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2017/Jul/31

[Third Party Advisory] http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl

... and 49 more

Scores

CVSS v3 5.5

EPSS 0.0015

EPSS Percentile 35.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-203

Status draft

Affected Products (42)

openssl/openssl

... and 27 more

Timeline

Published Jun 20, 2016

Tracked Since Feb 18, 2026