CVE-2016-2107
Fixed in a distro release EPSS 89%
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
Products: redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_hpc_node_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_workstation, opensuse leap, opensuse, openssl, google android, hp helion_openstack, nodejs node.js, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.2 | openssl | 1.0.2h-r0 |
| Alpine 3.3 | openssl | 1.0.2h-r0 |
| Alpine 3.4 | openssl | 1.0.2h-r0 |
| Alpine 3.5 | openssl | 1.0.2h-r0 |
| Alpine 3.6 | openssl | 1.0.2h-r0 |
| Alpine 3.7 | openssl | 1.0.2h-r0 |
| Alpine 3.8 | openssl | 1.0.2h-r0 |
| Debian 12 | openssl | 1.0.2h-1 |
| Debian 13 | openssl | 1.0.2h-1 |
| Debian 14 | openssl | 1.0.2h-1 |
| Debian 7 | openssl | 1.0.1e-2+deb7u21 |
| Debian 8 | openssl | 1.0.1k-3+deb8u5 |
| Red Hat Enterprise Linux 6 | openssl | 0:1.0.1e-48.el6_8.1 |
| Red Hat Enterprise Linux 6 | openssl-debuginfo | 0:1.0.1e-48.el6_8.1 |
| Red Hat Enterprise Linux 6 | openssl-devel | 0:1.0.1e-48.el6_8.1 |
| Red Hat Enterprise Linux 6 | openssl-perl | 0:1.0.1e-48.el6_8.1 |
| Red Hat Enterprise Linux 6 | openssl-static | 0:1.0.1e-48.el6_8.1 |
| Red Hat Enterprise Linux 7 | openssl | 1:1.0.1e-51.el7_2.5 |
| Red Hat Enterprise Linux 7 | openssl-debuginfo | 1:1.0.1e-51.el7_2.5 |
| Red Hat Enterprise Linux 7 | openssl-devel | 1:1.0.1e-51.el7_2.5 |
| Red Hat Enterprise Linux 7 | openssl-libs | 1:1.0.1e-51.el7_2.5 |
| Red Hat Enterprise Linux 7 | openssl-perl | 1:1.0.1e-51.el7_2.5 |
| Red Hat Enterprise Linux 7 | openssl-static | 1:1.0.1e-51.el7_2.5 |
| Red Hat rhel eus 6.7 | openssl | 0:1.0.1e-42.el6_7.5 |
| Red Hat rhel eus 6.7 | openssl-debuginfo | 0:1.0.1e-42.el6_7.5 |
| Red Hat rhel eus 6.7 | openssl-devel | 0:1.0.1e-42.el6_7.5 |
| Red Hat rhel eus 6.7 | openssl-perl | 0:1.0.1e-42.el6_7.5 |
| Red Hat rhel eus 6.7 | openssl-static | 0:1.0.1e-42.el6_7.5 |
| SUSE Linux Enterprise Desktop 12 | openssl | 1.0.1i-27.16.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | openssl | 1.0.1i-47.1 |
| SUSE Linux Enterprise Server 11-SECURITY | openssl1 | 1.0.1g-0.47.1 |
| SUSE Linux Enterprise Server 12 | openssl | 1.0.1i-27.16.1 |
| SUSE Linux Enterprise Server 12 SP1 | openssl | 1.0.1i-47.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | openssl | 1.0.1i-27.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | openssl | 1.0.1i-47.1 |
| SUSE Linux Enterprise Software Development Kit 12 | openssl | 1.0.1i-27.16.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | openssl | 1.0.1i-47.1 |
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.19 |
| Ubuntu 16.04 LTS | openssl | 1.0.2g-1ubuntu4.1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 |