Sensitive information sent insecurely In openssl
Description
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.3 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2f-r0 || =1.0.2g-r0 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.4 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.5 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.6 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.7 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.8 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
 debian 12 | >=0 <1.0.2h-1 | 1.0.2h-1 | |
debian 14 | >=0 <1.0.2h-1 | 1.0.2h-1 | |
alpine v3.2 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2f-r0 || =1.0.2g-r0 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
debian 11 | >=0 <1.0.2h-1 | 1.0.2h-1 |
1-10 of 15
10
Aliases
1. CVE-2016-21072. NVD-2016-21073. OSV-ALPINE-2016-21074. OSV-2016-21075. OSV-DEBIAN-2016-21076. GCVE-2016-21077. SECURITY-CVE-2016-21078. SECURITY-TRACKER-CVE-2016-21079. kb.juniper.net10. lists.apple.com11. lists.fedoraproject.org12. lists.fedoraproject.org13. lists.fedoraproject.org14. lists.opensuse.org15. lists.opensuse.org16. lists.opensuse.org17. lists.opensuse.org18. lists.opensuse.org19. lists.opensuse.org20. lists.opensuse.org21. lists.opensuse.org22. packetstormsecurity.com23. rhn.redhat.com24. rhn.redhat.com25. rhn.redhat.com26. rhn.redhat.com27. source.android.com28. support.citrix.com29. tools.cisco.com30. web-in-security.blogspot.ca31. DEBIAN-dsa-356632. oracle.com33. oracle.com34. securityfocus.com35. securityfocus.com36. securitytracker.com37. slackware.com38. ubuntu.com39. blog.cloudflare.com40. cert-portal.siemens.com41. h20566.www2.hpe.com42. h20566.www2.hpe.com43. h20566.www2.hpe.com44. h20566.www2.hpe.com45. h20566.www2.hpe.com46. h20566.www2.hpe.com47. h20566.www2.hpe.com48. h20566.www2.hpe.com49. kb.pulsesecure.net50. kc.mcafee.com51. security.gentoo.org52. security.netapp.com53. support.apple.com54. exploit-db.com55. freebsd.org56. openssl.org
References
1. https://www.exploit-db.com/exploits/397682. https://github.com/FiloSottile/CVE-2016-21073. https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=68595c0c2886e7942a14f98c17a55a88afb6c2924. https://bto.bluecoat.com/security-advisory/sa1235. http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html6. http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html7. http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html8. http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html9. http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html10. http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html11. http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.