openssl: ECDSA P-256 timing attack key recovery

🗓️ 25 Jul 2017 17:46:13Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

A timing attack flaw in OpenSSL could allow a local attacker to recover ECDSA P-256 private keys.

Reporter	Title	Published	Views	Family All 113
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities GSKit bundled with IBM HTTP Server	29 Oct 201815:00	–	ibm
IBM Security Bulletins	WebSphere Application Server and IBM HTTP Server Security Bulletin List	13 Jul 202218:04	–	ibm
FreeBSD	openssl -- timing attack vulnerability	10 Jan 201700:00	–	freebsd
Apple	About the security content of macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite	27 Mar 201700:00	–	apple
Apple	About the security content of macOS Sierra 10.12.4, Security Update 2017-001 El Capitan, and Security Update 2017-001 Yosemite - Apple Support	29 Aug 201702:52	–	apple
BDU FSTEC	The vulnerability of the OpenSSL library, related to errors in managing cryptographic keys, allows a hacker to recover secret ECDSA P-256 keys.	20 Apr 202200:00	–	bdu_fstec
Broadcom	BSA-2017-383	25 Aug 201700:00	–	broadcom
Cloud Foundry	USN-3181-1: OpenSSL vulnerabilities \| Cloud Foundry	2 Jun 201700:00	–	cloudfoundry
Circl	CVE-2016-7056	10 Sep 201820:18	–	circl
CNVD	OpenSSL ECDSA P-256 Private Key Acquisition Vulnerability	12 Jan 201700:00	–	cnvd

Vulners

Node

redhat jboss_enterprise_web_serverRange<3.1

AND

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2016-7056
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2016-7056
cve	www.cve.org/CVERecord

28 May 2026 20:35Current

6.7Medium risk

Vulners AI Score6.7

CVSS 22.1

CVSS 35.5

EPSS0.00176

timing attack ecdsa p256 openssl local access private keys