csaf_suse - suse-su-2017:0461-1

Vulnerability from csaf_suse

Published

2017-02-14 14:18

Modified

2017-02-14 14:18

Summary

Security update for openssl

Notes

Title of the patch

Security update for openssl

Description of the patch

This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - fix ca-bundle path (bsc#1022271)

Patchnames

SUSE-SLE-DESKTOP-12-SP1-2017-236,SUSE-SLE-SDK-12-SP1-2017-236,SUSE-SLE-SERVER-12-SP1-2017-236

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for openssl",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "\nThis update for openssl fixes the following issues contained in the\nOpenSSL Security Advisory [26 Jan 2017] (bsc#1021641)\n\nSecurity issues fixed:\n- CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334)\n- CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878)\n- CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499)\n- CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731)\n- Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912)\n\nBugs fixed:\n- fix crash in openssl speed (bsc#1000677)\n- fix ca-bundle path (bsc#1022271)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-SLE-DESKTOP-12-SP1-2017-236,SUSE-SLE-SDK-12-SP1-2017-236,SUSE-SLE-SERVER-12-SP1-2017-236",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_0461-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2017:0461-1",
            url: "https://www.suse.com/support/update/announcement/2017/suse-su-20170461-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2017:0461-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2017-February/002642.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1000677",
            url: "https://bugzilla.suse.com/1000677",
         },
         {
            category: "self",
            summary: "SUSE Bug 1001912",
            url: "https://bugzilla.suse.com/1001912",
         },
         {
            category: "self",
            summary: "SUSE Bug 1004499",
            url: "https://bugzilla.suse.com/1004499",
         },
         {
            category: "self",
            summary: "SUSE Bug 1005878",
            url: "https://bugzilla.suse.com/1005878",
         },
         {
            category: "self",
            summary: "SUSE Bug 1019334",
            url: "https://bugzilla.suse.com/1019334",
         },
         {
            category: "self",
            summary: "SUSE Bug 1021641",
            url: "https://bugzilla.suse.com/1021641",
         },
         {
            category: "self",
            summary: "SUSE Bug 1022085",
            url: "https://bugzilla.suse.com/1022085",
         },
         {
            category: "self",
            summary: "SUSE Bug 1022271",
            url: "https://bugzilla.suse.com/1022271",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-2108 page",
            url: "https://www.suse.com/security/cve/CVE-2016-2108/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-7056 page",
            url: "https://www.suse.com/security/cve/CVE-2016-7056/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-8610 page",
            url: "https://www.suse.com/security/cve/CVE-2016-8610/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-3731 page",
            url: "https://www.suse.com/security/cve/CVE-2017-3731/",
         },
      ],
      title: "Security update for openssl",
      tracking: {
         current_release_date: "2017-02-14T14:18:29Z",
         generator: {
            date: "2017-02-14T14:18:29Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2017:0461-1",
         initial_release_date: "2017-02-14T14:18:29Z",
         revision_history: [
            {
               date: "2017-02-14T14:18:29Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "openssl-doc-1.0.1i-54.5.1.noarch",
                        product: {
                           name: "openssl-doc-1.0.1i-54.5.1.noarch",
                           product_id: "openssl-doc-1.0.1i-54.5.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                        product: {
                           name: "libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                           product_id: "libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                        product: {
                           name: "libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                           product_id: "libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                        product: {
                           name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                           product_id: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1.0.1i-54.5.1.ppc64le",
                        product: {
                           name: "openssl-1.0.1i-54.5.1.ppc64le",
                           product_id: "openssl-1.0.1i-54.5.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl-devel-1.0.1i-54.5.1.s390x",
                        product: {
                           name: "libopenssl-devel-1.0.1i-54.5.1.s390x",
                           product_id: "libopenssl-devel-1.0.1i-54.5.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                        product: {
                           name: "libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                           product_id: "libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                        product: {
                           name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                           product_id: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                        product: {
                           name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                           product_id: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                        product: {
                           name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                           product_id: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1.0.1i-54.5.1.s390x",
                        product: {
                           name: "openssl-1.0.1i-54.5.1.s390x",
                           product_id: "openssl-1.0.1i-54.5.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                        product: {
                           name: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                           product_id: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                        product: {
                           name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                           product_id: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1.0.1i-54.5.1.x86_64",
                        product: {
                           name: "openssl-1.0.1i-54.5.1.x86_64",
                           product_id: "openssl-1.0.1i-54.5.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl-devel-1.0.1i-54.5.1.x86_64",
                        product: {
                           name: "libopenssl-devel-1.0.1i-54.5.1.x86_64",
                           product_id: "libopenssl-devel-1.0.1i-54.5.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                        product: {
                           name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                           product_id: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                        product: {
                           name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                           product_id: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Desktop 12 SP1",
                        product: {
                           name: "SUSE Linux Enterprise Desktop 12 SP1",
                           product_id: "SUSE Linux Enterprise Desktop 12 SP1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sled:12:sp1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Software Development Kit 12 SP1",
                        product: {
                           name: "SUSE Linux Enterprise Software Development Kit 12 SP1",
                           product_id: "SUSE Linux Enterprise Software Development Kit 12 SP1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-sdk:12:sp1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP1",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP1",
                           product_id: "SUSE Linux Enterprise Server 12 SP1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles:12:sp1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp1",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
               product_id: "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Desktop 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
               product_id: "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Desktop 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
               product_id: "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "openssl-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Desktop 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-devel-1.0.1i-54.5.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
            },
            product_reference: "libopenssl-devel-1.0.1i-54.5.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-devel-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl-devel-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-devel-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP1",
               product_id: "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl-devel-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Software Development Kit 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-1.0.1i-54.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
            },
            product_reference: "libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
            },
            product_reference: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1.0.1i-54.5.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
            },
            product_reference: "openssl-1.0.1i-54.5.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
            },
            product_reference: "openssl-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "openssl-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-doc-1.0.1i-54.5.1.noarch as component of SUSE Linux Enterprise Server 12 SP1",
               product_id: "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
            },
            product_reference: "openssl-doc-1.0.1i-54.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-1.0.1i-54.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
            },
            product_reference: "libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
            },
            product_reference: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
            },
            product_reference: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1.0.1i-54.5.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
            },
            product_reference: "openssl-1.0.1i-54.5.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1.0.1i-54.5.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
            },
            product_reference: "openssl-1.0.1i-54.5.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1.0.1i-54.5.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
            },
            product_reference: "openssl-1.0.1i-54.5.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-doc-1.0.1i-54.5.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
            },
            product_reference: "openssl-doc-1.0.1i-54.5.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2016-2108",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-2108",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the \"negative zero\" issue.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-2108",
               url: "https://www.suse.com/security/cve/CVE-2016-2108",
            },
            {
               category: "external",
               summary: "SUSE Bug 1001502 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/1001502",
            },
            {
               category: "external",
               summary: "SUSE Bug 1004499 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/1004499",
            },
            {
               category: "external",
               summary: "SUSE Bug 1005878 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/1005878",
            },
            {
               category: "external",
               summary: "SUSE Bug 1148697 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/1148697",
            },
            {
               category: "external",
               summary: "SUSE Bug 977584 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/977584",
            },
            {
               category: "external",
               summary: "SUSE Bug 977617 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/977617",
            },
            {
               category: "external",
               summary: "SUSE Bug 978492 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/978492",
            },
            {
               category: "external",
               summary: "SUSE Bug 989345 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/989345",
            },
            {
               category: "external",
               summary: "SUSE Bug 996067 for CVE-2016-2108",
               url: "https://bugzilla.suse.com/996067",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-02-14T14:18:29Z",
               details: "important",
            },
         ],
         title: "CVE-2016-2108",
      },
      {
         cve: "CVE-2016-7056",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-7056",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-7056",
               url: "https://www.suse.com/security/cve/CVE-2016-7056",
            },
            {
               category: "external",
               summary: "SUSE Bug 1005878 for CVE-2016-7056",
               url: "https://bugzilla.suse.com/1005878",
            },
            {
               category: "external",
               summary: "SUSE Bug 1019334 for CVE-2016-7056",
               url: "https://bugzilla.suse.com/1019334",
            },
            {
               category: "external",
               summary: "SUSE Bug 1148697 for CVE-2016-7056",
               url: "https://bugzilla.suse.com/1148697",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-02-14T14:18:29Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-7056",
      },
      {
         cve: "CVE-2016-8610",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-8610",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-8610",
               url: "https://www.suse.com/security/cve/CVE-2016-8610",
            },
            {
               category: "external",
               summary: "SUSE Bug 1005878 for CVE-2016-8610",
               url: "https://bugzilla.suse.com/1005878",
            },
            {
               category: "external",
               summary: "SUSE Bug 1005879 for CVE-2016-8610",
               url: "https://bugzilla.suse.com/1005879",
            },
            {
               category: "external",
               summary: "SUSE Bug 1110018 for CVE-2016-8610",
               url: "https://bugzilla.suse.com/1110018",
            },
            {
               category: "external",
               summary: "SUSE Bug 1120592 for CVE-2016-8610",
               url: "https://bugzilla.suse.com/1120592",
            },
            {
               category: "external",
               summary: "SUSE Bug 1126909 for CVE-2016-8610",
               url: "https://bugzilla.suse.com/1126909",
            },
            {
               category: "external",
               summary: "SUSE Bug 1148697 for CVE-2016-8610",
               url: "https://bugzilla.suse.com/1148697",
            },
            {
               category: "external",
               summary: "SUSE Bug 982575 for CVE-2016-8610",
               url: "https://bugzilla.suse.com/982575",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-02-14T14:18:29Z",
               details: "important",
            },
         ],
         title: "CVE-2016-8610",
      },
      {
         cve: "CVE-2017-3731",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-3731",
            },
         ],
         notes: [
            {
               category: "general",
               text: "If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
               "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-3731",
               url: "https://www.suse.com/security/cve/CVE-2017-3731",
            },
            {
               category: "external",
               summary: "SUSE Bug 1021641 for CVE-2017-3731",
               url: "https://bugzilla.suse.com/1021641",
            },
            {
               category: "external",
               summary: "SUSE Bug 1022085 for CVE-2017-3731",
               url: "https://bugzilla.suse.com/1022085",
            },
            {
               category: "external",
               summary: "SUSE Bug 1064118 for CVE-2017-3731",
               url: "https://bugzilla.suse.com/1064118",
            },
            {
               category: "external",
               summary: "SUSE Bug 1064119 for CVE-2017-3731",
               url: "https://bugzilla.suse.com/1064119",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Desktop 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-1.0.1i-54.5.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-1.0.1i-54.5.1.noarch",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.ppc64le",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.s390x",
                  "SUSE Linux Enterprise Software Development Kit 12 SP1:libopenssl-devel-1.0.1i-54.5.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2017-02-14T14:18:29Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-3731",
      },
   ],
}

cve-2016-2108

Vulnerability from cvelistv5

Published

2016-05-05 00:00

Modified

2024-08-05 23:17

Severity ?

Summary

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

References

▼	URL	Tags
	http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-2056.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-2073.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us
	http://www.debian.org/security/2016/dsa-3566	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us
	http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
	http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html
	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html	vendor-advisory
	https://security.gentoo.org/glsa/201612-16	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html	vendor-advisory
	http://www.securitytracker.com/id/1035721	vdb-entry
	http://support.citrix.com/article/CTX212736
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345
	http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html	vendor-advisory
	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html	vendor-advisory
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871
	https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us
	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
	http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html	vendor-advisory
	http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html	vendor-advisory
	https://www.tenable.com/security/tns-2016-18
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:0194	vendor-advisory
	http://source.android.com/security/bulletin/2016-07-01.html
	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804
	https://access.redhat.com/errata/RHSA-2017:0193	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html	vendor-advisory
	https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202
	http://rhn.redhat.com/errata/RHSA-2016-0996.html	vendor-advisory
	https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr
	https://security.netapp.com/advisory/ntap-20160504-0001/
	http://www.securityfocus.com/bid/91787	vdb-entry
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-2957.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-2959-1	vendor-advisory
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
	http://rhn.redhat.com/errata/RHSA-2016-0722.html	vendor-advisory
	https://www.openssl.org/news/secadv/20160503.txt
	https://support.apple.com/HT206903
	https://bto.bluecoat.com/security-advisory/sa123
	http://www.securityfocus.com/bid/89752	vdb-entry
	http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2016:1137	vendor-advisory
	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T23:17:50.714Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "SSA:2016-124-01",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103",
               },
               {
                  name: "RHSA-2016:2056",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2056.html",
               },
               {
                  name: "openSUSE-SU-2016:1238",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html",
               },
               {
                  name: "openSUSE-SU-2016:1242",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html",
               },
               {
                  name: "SUSE-SU-2016:1267",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html",
               },
               {
                  name: "RHSA-2016:2073",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2073.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us",
               },
               {
                  name: "DSA-3566",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2016/dsa-3566",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
               },
               {
                  name: "openSUSE-SU-2016:1243",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html",
               },
               {
                  name: "GLSA-201612-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201612-16",
               },
               {
                  name: "SUSE-SU-2016:1228",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html",
               },
               {
                  name: "1035721",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1035721",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://support.citrix.com/article/CTX212736",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27",
               },
               {
                  name: "openSUSE-SU-2016:1239",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html",
               },
               {
                  name: "SUSE-SU-2016:1206",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345",
               },
               {
                  name: "FEDORA-2016-1e39d934ed",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html",
               },
               {
                  name: "20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl",
               },
               {
                  name: "SUSE-SU-2016:1231",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
               },
               {
                  name: "FEDORA-2016-1411324654",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html",
               },
               {
                  name: "openSUSE-SU-2016:1240",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862",
               },
               {
                  name: "openSUSE-SU-2016:1241",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html",
               },
               {
                  name: "APPLE-SA-2016-07-18-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html",
               },
               {
                  name: "SUSE-SU-2016:1360",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2016-18",
               },
               {
                  name: "SUSE-SU-2016:1233",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html",
               },
               {
                  name: "RHSA-2017:0194",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:0194",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://source.android.com/security/bulletin/2016-07-01.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804",
               },
               {
                  name: "RHSA-2017:0193",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:0193",
               },
               {
                  name: "openSUSE-SU-2016:1237",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202",
               },
               {
                  name: "RHSA-2016:0996",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-0996.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20160504-0001/",
               },
               {
                  name: "91787",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/91787",
               },
               {
                  name: "SUSE-SU-2016:1290",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html",
               },
               {
                  name: "openSUSE-SU-2016:1273",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html",
               },
               {
                  name: "RHSA-2016:2957",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
               },
               {
                  name: "USN-2959-1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/USN-2959-1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "RHSA-2016:0722",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-0722.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openssl.org/news/secadv/20160503.txt",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/HT206903",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bto.bluecoat.com/security-advisory/sa123",
               },
               {
                  name: "89752",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/89752",
               },
               {
                  name: "FEDORA-2016-05c567df1a",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html",
               },
               {
                  name: "RHSA-2016:1137",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2016:1137",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-05-03T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the \"negative zero\" issue.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-13T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "SSA:2016-124-01",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103",
            },
            {
               name: "RHSA-2016:2056",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2056.html",
            },
            {
               name: "openSUSE-SU-2016:1238",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html",
            },
            {
               name: "openSUSE-SU-2016:1242",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html",
            },
            {
               name: "SUSE-SU-2016:1267",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html",
            },
            {
               name: "RHSA-2016:2073",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2073.html",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us",
            },
            {
               name: "DSA-3566",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.debian.org/security/2016/dsa-3566",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
            },
            {
               url: "http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
            },
            {
               name: "openSUSE-SU-2016:1243",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html",
            },
            {
               name: "GLSA-201612-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/201612-16",
            },
            {
               name: "SUSE-SU-2016:1228",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html",
            },
            {
               name: "1035721",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1035721",
            },
            {
               url: "http://support.citrix.com/article/CTX212736",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27",
            },
            {
               name: "openSUSE-SU-2016:1239",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html",
            },
            {
               name: "SUSE-SU-2016:1206",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345",
            },
            {
               name: "FEDORA-2016-1e39d934ed",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html",
            },
            {
               name: "20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl",
            },
            {
               name: "SUSE-SU-2016:1231",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html",
            },
            {
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871",
            },
            {
               url: "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us",
            },
            {
               url: "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
            },
            {
               name: "FEDORA-2016-1411324654",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html",
            },
            {
               name: "openSUSE-SU-2016:1240",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862",
            },
            {
               name: "openSUSE-SU-2016:1241",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html",
            },
            {
               name: "APPLE-SA-2016-07-18-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html",
            },
            {
               name: "SUSE-SU-2016:1360",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html",
            },
            {
               url: "https://www.tenable.com/security/tns-2016-18",
            },
            {
               name: "SUSE-SU-2016:1233",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html",
            },
            {
               name: "RHSA-2017:0194",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:0194",
            },
            {
               url: "http://source.android.com/security/bulletin/2016-07-01.html",
            },
            {
               url: "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804",
            },
            {
               name: "RHSA-2017:0193",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:0193",
            },
            {
               name: "openSUSE-SU-2016:1237",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html",
            },
            {
               url: "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202",
            },
            {
               name: "RHSA-2016:0996",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-0996.html",
            },
            {
               url: "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067&languageid=en-fr",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20160504-0001/",
            },
            {
               name: "91787",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/91787",
            },
            {
               name: "SUSE-SU-2016:1290",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html",
            },
            {
               name: "openSUSE-SU-2016:1273",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html",
            },
            {
               name: "RHSA-2016:2957",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
            },
            {
               name: "USN-2959-1",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://www.ubuntu.com/usn/USN-2959-1",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "RHSA-2016:0722",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-0722.html",
            },
            {
               url: "https://www.openssl.org/news/secadv/20160503.txt",
            },
            {
               url: "https://support.apple.com/HT206903",
            },
            {
               url: "https://bto.bluecoat.com/security-advisory/sa123",
            },
            {
               name: "89752",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/89752",
            },
            {
               name: "FEDORA-2016-05c567df1a",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html",
            },
            {
               name: "RHSA-2016:1137",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2016:1137",
            },
            {
               url: "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
            },
            {
               url: "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-2108",
      datePublished: "2016-05-05T00:00:00",
      dateReserved: "2016-01-29T00:00:00",
      dateUpdated: "2024-08-05T23:17:50.714Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-3731

Vulnerability from cvelistv5

Published

2017-05-04 19:00

Modified

2024-09-16 22:40

Severity ?

Summary

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.

References

▼	URL	Tags
	https://access.redhat.com/errata/RHSA-2018:2185	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2186	vendor-advisory, x_refsource_REDHAT
	https://security.netapp.com/advisory/ntap-20171019-0002/	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/95813	vdb-entry, x_refsource_BID
	http://rhn.redhat.com/errata/RHSA-2017-0286.html	vendor-advisory, x_refsource_REDHAT
	https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc	vendor-advisory, x_refsource_FREEBSD
	https://www.openssl.org/news/secadv/20170126.txt	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037717	vdb-entry, x_refsource_SECTRACK
	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	x_refsource_CONFIRM
	https://www.tenable.com/security/tns-2017-04	x_refsource_CONFIRM
	https://source.android.com/security/bulletin/pixel/2017-11-01	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201702-07	vendor-advisory, x_refsource_GENTOO
	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	x_refsource_CONFIRM
	http://www.debian.org/security/2017/dsa-3773	vendor-advisory, x_refsource_DEBIAN
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2187	vendor-advisory, x_refsource_REDHAT
	https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	x_refsource_MISC
	https://security.paloaltonetworks.com/CVE-2017-3731	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: openssl-1.1.0 Version: openssl-1.1.0a Version: openssl-1.1.0b Version: openssl-1.1.0c Version: openssl-1.0.2 Version: openssl-1.0.2a Version: openssl-1.0.2b Version: openssl-1.0.2c Version: openssl-1.0.2d Version: openssl-1.0.2e Version: openssl-1.0.2f Version: openssl-1.0.2g Version: openssl-1.0.2h Version: openssl-1.0.2i Version: openssl-1.0.2j

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T14:39:40.936Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2018:2185",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2185",
               },
               {
                  name: "RHSA-2018:2186",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2186",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20171019-0002/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  name: "95813",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/95813",
               },
               {
                  name: "RHSA-2017:0286",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-0286.html",
               },
               {
                  name: "FreeBSD-SA-17:02",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FREEBSD",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.openssl.org/news/secadv/20170126.txt",
               },
               {
                  name: "1037717",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037717",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/tns-2017-04",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://source.android.com/security/bulletin/pixel/2017-11-01",
               },
               {
                  name: "GLSA-201702-07",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201702-07",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
               },
               {
                  name: "DSA-3773",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2017/dsa-3773",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us",
               },
               {
                  name: "RHSA-2018:2187",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2187",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.paloaltonetworks.com/CVE-2017-3731",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "OpenSSL",
               vendor: "OpenSSL",
               versions: [
                  {
                     status: "affected",
                     version: "openssl-1.1.0",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.1.0a",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.1.0b",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.1.0c",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2a",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2b",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2c",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2d",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2e",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2f",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2g",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2h",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2i",
                  },
                  {
                     status: "affected",
                     version: "openssl-1.0.2j",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Robert Święcki of Google",
            },
         ],
         datePublic: "2017-01-26T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     lang: "eng",
                     url: "https://www.openssl.org/policies/secpolicy.html#Moderate",
                     value: "Moderate",
                  },
                  type: "unknown",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "out-of-bounds read",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-02-17T16:03:45",
            orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
            shortName: "openssl",
         },
         references: [
            {
               name: "RHSA-2018:2185",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2185",
            },
            {
               name: "RHSA-2018:2186",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2186",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20171019-0002/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               name: "95813",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/95813",
            },
            {
               name: "RHSA-2017:0286",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-0286.html",
            },
            {
               name: "FreeBSD-SA-17:02",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FREEBSD",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.openssl.org/news/secadv/20170126.txt",
            },
            {
               name: "1037717",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1037717",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.tenable.com/security/tns-2017-04",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://source.android.com/security/bulletin/pixel/2017-11-01",
            },
            {
               name: "GLSA-201702-07",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201702-07",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
            },
            {
               name: "DSA-3773",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "http://www.debian.org/security/2017/dsa-3773",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us",
            },
            {
               name: "RHSA-2018:2187",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2187",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.paloaltonetworks.com/CVE-2017-3731",
            },
         ],
         title: "Truncated packet could crash via OOB read",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "openssl-security@openssl.org",
               DATE_PUBLIC: "2017-01-26",
               ID: "CVE-2017-3731",
               STATE: "PUBLIC",
               TITLE: "Truncated packet could crash via OOB read",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "OpenSSL",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "openssl-1.1.0",
                                       },
                                       {
                                          version_value: "openssl-1.1.0a",
                                       },
                                       {
                                          version_value: "openssl-1.1.0b",
                                       },
                                       {
                                          version_value: "openssl-1.1.0c",
                                       },
                                       {
                                          version_value: "openssl-1.0.2",
                                       },
                                       {
                                          version_value: "openssl-1.0.2a",
                                       },
                                       {
                                          version_value: "openssl-1.0.2b",
                                       },
                                       {
                                          version_value: "openssl-1.0.2c",
                                       },
                                       {
                                          version_value: "openssl-1.0.2d",
                                       },
                                       {
                                          version_value: "openssl-1.0.2e",
                                       },
                                       {
                                          version_value: "openssl-1.0.2f",
                                       },
                                       {
                                          version_value: "openssl-1.0.2g",
                                       },
                                       {
                                          version_value: "openssl-1.0.2h",
                                       },
                                       {
                                          version_value: "openssl-1.0.2i",
                                       },
                                       {
                                          version_value: "openssl-1.0.2j",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "OpenSSL",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "Robert Święcki of Google",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.",
                  },
               ],
            },
            impact: [
               {
                  lang: "eng",
                  url: "https://www.openssl.org/policies/secpolicy.html#Moderate",
                  value: "Moderate",
               },
            ],
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "out-of-bounds read",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "RHSA-2018:2185",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2185",
                  },
                  {
                     name: "RHSA-2018:2186",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2186",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20171019-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20171019-0002/",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
                  },
                  {
                     name: "95813",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/95813",
                  },
                  {
                     name: "RHSA-2017:0286",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2017-0286.html",
                  },
                  {
                     name: "FreeBSD-SA-17:02",
                     refsource: "FREEBSD",
                     url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc",
                  },
                  {
                     name: "https://www.openssl.org/news/secadv/20170126.txt",
                     refsource: "CONFIRM",
                     url: "https://www.openssl.org/news/secadv/20170126.txt",
                  },
                  {
                     name: "1037717",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1037717",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
                  },
                  {
                     name: "https://www.tenable.com/security/tns-2017-04",
                     refsource: "CONFIRM",
                     url: "https://www.tenable.com/security/tns-2017-04",
                  },
                  {
                     name: "https://source.android.com/security/bulletin/pixel/2017-11-01",
                     refsource: "CONFIRM",
                     url: "https://source.android.com/security/bulletin/pixel/2017-11-01",
                  },
                  {
                     name: "GLSA-201702-07",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201702-07",
                  },
                  {
                     name: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
                     refsource: "CONFIRM",
                     url: "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
                  },
                  {
                     name: "DSA-3773",
                     refsource: "DEBIAN",
                     url: "http://www.debian.org/security/2017/dsa-3773",
                  },
                  {
                     name: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us",
                     refsource: "CONFIRM",
                     url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us",
                  },
                  {
                     name: "RHSA-2018:2187",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2187",
                  },
                  {
                     name: "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21",
                     refsource: "MISC",
                     url: "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21",
                  },
                  {
                     name: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
                  },
                  {
                     name: "https://security.paloaltonetworks.com/CVE-2017-3731",
                     refsource: "CONFIRM",
                     url: "https://security.paloaltonetworks.com/CVE-2017-3731",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
      assignerShortName: "openssl",
      cveId: "CVE-2017-3731",
      datePublished: "2017-05-04T19:00:00Z",
      dateReserved: "2016-12-16T00:00:00",
      dateUpdated: "2024-09-16T22:40:54.865Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-8610

Vulnerability from cvelistv5

Published

2017-11-13 22:00

Modified

2024-08-06 02:27

Severity ?

Summary

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/93841	vdb-entry, x_refsource_BID
	http://rhn.redhat.com/errata/RHSA-2017-1659.html	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1658	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1801	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2017-0286.html	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1413	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2494	vendor-advisory, x_refsource_REDHAT
	https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc	vendor-advisory, x_refsource_FREEBSD
	https://access.redhat.com/errata/RHSA-2017:1414	vendor-advisory, x_refsource_REDHAT
	http://seclists.org/oss-sec/2016/q4/224	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2017-0574.html	vendor-advisory, x_refsource_REDHAT
	https://www.debian.org/security/2017/dsa-3773	vendor-advisory, x_refsource_DEBIAN
	http://rhn.redhat.com/errata/RHSA-2017-1415.html	vendor-advisory, x_refsource_REDHAT
	http://www.securitytracker.com/id/1037084	vdb-entry, x_refsource_SECTRACK
	https://access.redhat.com/errata/RHSA-2017:1802	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2493	vendor-advisory, x_refsource_REDHAT
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20171130-0001/	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610	x_refsource_CONFIRM
	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401	x_refsource_CONFIRM
	https://security.360.cn/cve/CVE-2016-8610/	x_refsource_MISC
	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us	x_refsource_CONFIRM
	https://security.paloaltonetworks.com/CVE-2016-8610	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: All 0.9.8 Version: All 1.0.1 Version: 1.0.2 through 1.0.2h Version: 1.1.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:27:40.949Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "93841",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/93841",
               },
               {
                  name: "RHSA-2017:1659",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
               },
               {
                  name: "RHSA-2017:1658",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1658",
               },
               {
                  name: "RHSA-2017:1801",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1801",
               },
               {
                  name: "RHSA-2017:0286",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-0286.html",
               },
               {
                  name: "RHSA-2017:1413",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1413",
               },
               {
                  name: "RHSA-2017:2494",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2494",
               },
               {
                  name: "FreeBSD-SA-16:35",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FREEBSD",
                     "x_transferred",
                  ],
                  url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc",
               },
               {
                  name: "RHSA-2017:1414",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1414",
               },
               {
                  name: "[oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/oss-sec/2016/q4/224",
               },
               {
                  name: "RHSA-2017:0574",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-0574.html",
               },
               {
                  name: "DSA-3773",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2017/dsa-3773",
               },
               {
                  name: "RHSA-2017:1415",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
               },
               {
                  name: "1037084",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037084",
               },
               {
                  name: "RHSA-2017:1802",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1802",
               },
               {
                  name: "RHSA-2017:2493",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:2493",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2020.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20171130-0001/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://security.360.cn/cve/CVE-2016-8610/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.paloaltonetworks.com/CVE-2016-8610",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "OpenSSL",
               vendor: "OpenSSL",
               versions: [
                  {
                     status: "affected",
                     version: "All 0.9.8",
                  },
                  {
                     status: "affected",
                     version: "All 1.0.1",
                  },
                  {
                     status: "affected",
                     version: "1.0.2 through 1.0.2h",
                  },
                  {
                     status: "affected",
                     version: "1.1.0",
                  },
               ],
            },
         ],
         datePublic: "2016-10-24T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-10-20T21:14:51",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "93841",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/93841",
            },
            {
               name: "RHSA-2017:1659",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-1659.html",
            },
            {
               name: "RHSA-2017:1658",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1658",
            },
            {
               name: "RHSA-2017:1801",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1801",
            },
            {
               name: "RHSA-2017:0286",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-0286.html",
            },
            {
               name: "RHSA-2017:1413",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1413",
            },
            {
               name: "RHSA-2017:2494",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2494",
            },
            {
               name: "FreeBSD-SA-16:35",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FREEBSD",
               ],
               url: "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc",
            },
            {
               name: "RHSA-2017:1414",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1414",
            },
            {
               name: "[oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://seclists.org/oss-sec/2016/q4/224",
            },
            {
               name: "RHSA-2017:0574",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-0574.html",
            },
            {
               name: "DSA-3773",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2017/dsa-3773",
            },
            {
               name: "RHSA-2017:1415",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
            },
            {
               name: "1037084",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1037084",
            },
            {
               name: "RHSA-2017:1802",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1802",
            },
            {
               name: "RHSA-2017:2493",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:2493",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2020.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20171130-0001/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://security.360.cn/cve/CVE-2016-8610/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.paloaltonetworks.com/CVE-2016-8610",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-8610",
      datePublished: "2017-11-13T22:00:00Z",
      dateReserved: "2016-10-12T00:00:00",
      dateUpdated: "2024-08-06T02:27:40.949Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-7056

Vulnerability from cvelistv5

Published

2018-09-10 16:00

Modified

2024-08-06 01:50

Severity ?

5.5 (Medium) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.

References

▼	URL	Tags
	https://eprint.iacr.org/2016/1195	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2017:1801	vendor-advisory, x_refsource_REDHAT
	https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1413	vendor-advisory, x_refsource_REDHAT
	https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037575	vdb-entry, x_refsource_SECTRACK
	https://access.redhat.com/errata/RHSA-2017:1414	vendor-advisory, x_refsource_REDHAT
	https://seclists.org/oss-sec/2017/q1/52	mailing-list, x_refsource_MLIST
	https://www.debian.org/security/2017/dsa-3773	vendor-advisory, x_refsource_DEBIAN
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056	x_refsource_CONFIRM
	https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/95375	vdb-entry, x_refsource_BID
	http://rhn.redhat.com/errata/RHSA-2017-1415.html	vendor-advisory, x_refsource_REDHAT
	https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig	x_refsource_CONFIRM
	https://security-tracker.debian.org/tracker/CVE-2016-7056	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1802	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	The OpenSSL Project	openssl	Version: openssl 1.0.1u

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T01:50:46.703Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://eprint.iacr.org/2016/1195",
               },
               {
                  name: "RHSA-2017:1801",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1801",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008",
               },
               {
                  name: "RHSA-2017:1413",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1413",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig",
               },
               {
                  name: "1037575",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037575",
               },
               {
                  name: "RHSA-2017:1414",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1414",
               },
               {
                  name: "[oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/oss-sec/2017/q1/52",
               },
               {
                  name: "DSA-3773",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2017/dsa-3773",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html",
               },
               {
                  name: "95375",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/95375",
               },
               {
                  name: "RHSA-2017:1415",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security-tracker.debian.org/tracker/CVE-2016-7056",
               },
               {
                  name: "RHSA-2017:1802",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1802",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "openssl",
               vendor: "The OpenSSL Project",
               versions: [
                  {
                     status: "affected",
                     version: "openssl 1.0.1u",
                  },
               ],
            },
         ],
         datePublic: "2017-01-10T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-385",
                     description: "CWE-385",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-09-11T20:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://eprint.iacr.org/2016/1195",
            },
            {
               name: "RHSA-2017:1801",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1801",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008",
            },
            {
               name: "RHSA-2017:1413",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1413",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig",
            },
            {
               name: "1037575",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1037575",
            },
            {
               name: "RHSA-2017:1414",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1414",
            },
            {
               name: "[oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://seclists.org/oss-sec/2017/q1/52",
            },
            {
               name: "DSA-3773",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2017/dsa-3773",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html",
            },
            {
               name: "95375",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/95375",
            },
            {
               name: "RHSA-2017:1415",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2017-1415.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security-tracker.debian.org/tracker/CVE-2016-7056",
            },
            {
               name: "RHSA-2017:1802",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1802",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-7056",
      datePublished: "2018-09-10T16:00:00",
      dateReserved: "2016-08-23T00:00:00",
      dateUpdated: "2024-08-06T01:50:46.703Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2016-2108

Vulnerability from cvelistv5

cve-2017-3731

Vulnerability from cvelistv5

cve-2016-8610

Vulnerability from cvelistv5

cve-2016-7056

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature