openssl: Non-constant time codepath followed for certain operations in DSA implementation

🗓️ 27 Sep 2016 13:46:00Reported by RedHatType

OpenSSL Digital Signature Algorithm signatures may not use constant time, risking private key exposure by a local attacker.

Reporter	Title	Published	Views	Family All 345
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affects IBM Rational ClearCase (CVE-2016-2177, CVE-2016-2178, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6306)	10 Jul 201808:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities fixed in IBM Security Privileged Identity Manager	16 Jun 201821:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by OpenSSL Security Advisory [22 Sep 2016] and [26 Sep 2016] vulnerabilities (multiple CVEs)	16 Jun 201821:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Flex System Manager (FSM) Storage Manager Install Anywhere (SMIA) configuration tool	18 Jun 201801:34	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affect IBM SmartCloud Entry	19 Jul 202000:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Image Construction and Composition Tool.	15 Jun 201807:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities may affect IBM® SDK for Node.js™	9 Aug 201804:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Enterprise Server, Connect Server, Point to Point Client, Desktop Client, Faspstream, Cargo, and Sync (CVE-2016-6302 CVE-2016-6304 CVE-2016-6303 CVE-2016-2182 CVE-2016-2177 CVE-2016-2178 ...)	15 Jun 201807:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Composite Application Manager for Transactions	17 Jun 201815:39	–	ibm
IBM Security Bulletins	Security Bulletin: Fabric OS firmware for Brocade 8Gb SAN Switch Module for BladeCenter is affected by vulnerabilities in OpenSSL and OpenSSH	16 Jun 201915:15	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	6	ppc	openssl	0:1.0.1e-48.el6_8.3	openssl-0:1.0.1e-48.el6_8.3.ppc.rpm
Red Hat Enterprise Linux	6	ppc64	openssl	0:1.0.1e-48.el6_8.3	openssl-0:1.0.1e-48.el6_8.3.ppc64.rpm
Red Hat Enterprise Linux	6	s390	openssl	0:1.0.1e-48.el6_8.3	openssl-0:1.0.1e-48.el6_8.3.s390.rpm
Red Hat Enterprise Linux	6	s390x	openssl	0:1.0.1e-48.el6_8.3	openssl-0:1.0.1e-48.el6_8.3.s390x.rpm
Red Hat Enterprise Linux	6	x86_64	openssl	0:1.0.1e-48.el6_8.3	openssl-0:1.0.1e-48.el6_8.3.x86_64.rpm
Red Hat Enterprise Linux	6	any	openssl	0:1.0.1e-48.el6_8.3.i686	openssl-0:1.0.1e-48.el6_8.3.i686.noarch.rpm
Red Hat Enterprise Linux	7	ppc64	openssl	1:1.0.1e-51.el7_2.7	openssl-1:1.0.1e-51.el7_2.7.ppc64.rpm
Red Hat Enterprise Linux	7	ppc64le	openssl	1:1.0.1e-51.el7_2.7	openssl-1:1.0.1e-51.el7_2.7.ppc64le.rpm
Red Hat Enterprise Linux	7	s390x	openssl	1:1.0.1e-51.el7_2.7	openssl-1:1.0.1e-51.el7_2.7.s390x.rpm
Red Hat Enterprise Linux	7	x86_64	openssl	1:1.0.1e-51.el7_2.7	openssl-1:1.0.1e-51.el7_2.7.x86_64.rpm

Source	Link
eprint	www.eprint.iacr.org/2016/594
access	www.access.redhat.com/security/cve/CVE-2016-2178
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2016-2178
cve	www.cve.org/CVERecord
openssl	www.openssl.org/news/secadv/20160922.txt

03 Jun 2026 17:12Current

7.2High risk

Vulners AI Score7.2

CVSS 22.1

CVSS 3.15.5

EPSS0.00189

CWE-385