CVE-2016-2109

Published May 5, 2016

Last updated a year ago

Overview

Description: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.
Source: secalert@redhat.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.0

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 7.8
Impact score: 6.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:N/A:C

Weaknesses

nvd@nist.gov: CWE-399

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C1F608A0-78BE-4F17-9E41-70933E52B3C7",
            "versionEndIncluding": "1.0.1s"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD3E5C1B-EC63-4214-A0BD-0B8681CE6C8B"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "18797BEE-417D-4959-9AAD-C5A7C051B524"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6FAA3C31-BD9D-45A9-A502-837FECA6D479"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6455A421-9956-4846-AC7C-3431E0D37D23"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "60F946FD-F564-49DA-B043-5943308BA9EE"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4847BCF3-EFCE-41AF-8E7D-3D51EB9DCC5B"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9B89180B-FB68-4DD8-B076-16E51CC7FB91"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4C986592-4086-4A39-9767-EF34DBAA6A53"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7B23181C-03DB-4E92-B3F6-6B585B5231B4"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "94D9EC1C-4843-4026-9B05-E060E9391734"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B066401C-21CF-4BE9-9C55-C9F1E0C7BE3F"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3C84489B-B08C-4854-8A12-D01B6E45CF79"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "39A901D6-0874-46A4-92A8-5F72C7A89E85"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1C8D871B-AEA1-4407-AEE3-47EC782250FF"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "44B067C7-735E-43C9-9188-7E1522A02491"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C2FAC325-6EEB-466D-9EBA-8ED4DBC9CFBF"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Configurations

References