Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

releasealert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2016-2107 — MEDIUM severity vulnerability | Release Alert

CVE-2016-2107

5.9

MEDIUMCVSS v3

Published

May 5, 2016

CVSS v2

2.6 LOW

Affected

6 projects

Assigned by

Red Hat

Severity scale

010

Description

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

openssl/openssl

GitHubGeneral purpose TLS and crypto library

= 1.0.2a, = 1.0.2e, = 1.0.2b, = 1.0.2g, = 1.0.2c, = 1.0.2, <= 1.0.1s, = 1.0.2f, = 1.0.2dNVD

openssl

NPMNodejs openssl wrapper

= 1.0.2a, = 1.0.2e, = 1.0.2b, = 1.0.2g, = 1.0.2c, = 1.0.2, <= 1.0.1s, = 1.0.2f, = 1.0.2dNVD

nodejs

Python Package Index

More on this CVE

NVD↗GitHub Advisory↗

Python bindings and utils for Node.js and io.js

= 6.0.0, >= 4.0.0, <= 4.1.2, >= 0.12.0, < 0.12.14, >= 0.10.0, < 0.10.45, >= 4.2.0, < 4.4.4, >= 5.0.0, < 5.11.1NVD

nodejs

NPM

= 6.0.0, >= 4.0.0, <= 4.1.2, >= 0.12.0, < 0.12.14, >= 0.10.0, < 0.10.45, >= 4.2.0, < 4.4.4, >= 5.0.0, < 5.11.1NVD

Node.js

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

= 6.0.0, >= 4.0.0, <= 4.1.2, >= 0.12.0, < 0.12.14, >= 0.10.0, < 0.10.45, >= 4.2.0, < 4.4.4, >= 5.0.0, < 5.11.1NVD

openssl

Crates.ioOpenSSL bindings

= 1.0.2a, = 1.0.2e, = 1.0.2b, = 1.0.2g, = 1.0.2c, = 1.0.2, <= 1.0.1s, = 1.0.2f, = 1.0.2dNVD