CVE-2016-7056

MEDIUM

OpenSSL < 1.0.1u - Timing Attack ECDSA P-256 Private Key Recovery

Title source: llm
STIX 2.1

Description

A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.

References (16)

Core 16
Core References
Third Party Advisory x_refsource_misc
https://eprint.iacr.org/2016/1195
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1801
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1413
Patch, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037575
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1414
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://seclists.org/oss-sec/2017/q1/52
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2017/dsa-3773
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056
Patch, Third Party Advisory x_refsource_confirm
https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95375
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2017-1415.html
Patch, Third Party Advisory, VDB Entry x_refsource_confirm
https://security-tracker.debian.org/tracker/CVE-2016-7056
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1802

Scores

CVSS v3 5.5
EPSS 0.0033
EPSS Percentile 56.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-320 CWE-385
Status published
Products (7)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
debian/debian_linux 8.0
debian/debian_linux 9.0
openssl/openssl < 1.0.1u
redhat/enterprise_linux 6.0
redhat/enterprise_linux 7.0
Published Sep 10, 2018
Tracked Since Feb 18, 2026