Basic search

K
osvGoogleOSV:DSA-3673-2
HistorySep 22, 2016 - 12:00 a.m.

openssl - regression update

2016-09-2200:00:00
Google
osv.dev
16

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.145 Low

EPSS

Percentile

94.9%

Several vulnerabilities were discovered in OpenSSL:

  • CVE-2016-2177
    Guido Vranken discovered that OpenSSL uses undefined pointer
    arithmetic. Additional information can be found at
    <https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/&gt;
  • CVE-2016-2178
    Cesar Pereida, Billy Brumley and Yuval Yarom discovered a timing
    leak in the DSA code.
  • CVE-2016-2179 / CVE-2016-2181
    Quan Luo and the OCAP audit team discovered denial of service
    vulnerabilities in DTLS.
  • CVE-2016-2180 / CVE-2016-2182 / CVE-2016-6303
    Shi Lei discovered an out-of-bounds memory read in
    TS_OBJ_print_bio() and an out-of-bounds write in BN_bn2dec()
    and MDC2_Update().
  • CVE-2016-2183
    DES-based cipher suites are demoted from the HIGH group to MEDIUM
    as a mitigation for the SWEET32 attack.
  • CVE-2016-6302
    Shi Lei discovered that the use of SHA512 in TLS session tickets
    is susceptible to denial of service.
  • CVE-2016-6304
    Shi Lei discovered that excessively large OCSP status request may
    result in denial of service via memory exhaustion.
  • CVE-2016-6306
    Shi Lei discovered that missing message length validation when parsing
    certificates may potentially result in denial of service.

For the stable distribution (jessie), these problems have been fixed in
version 1.0.1t-1+deb8u4.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your openssl packages.

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.145 Low

EPSS

Percentile

94.9%

Related for OSV:DSA-3673-2