CVE-2016-2183
At a glance
- Source
- NVD
- EPSS
- EPSS 94.70 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
- https://access.redhat.com/errata/RHSA-2017:3113
- http://rhn.redhat.com/errata/RHSA-2017-0338.html
- https://www.tenable.com/security/tns-2016-20
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us
- https://security.gentoo.org/glsa/201612-16
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415
- https://access.redhat.com/errata/RHSA-2017:3240
- https://www.tenable.com/security/tns-2016-16
- https://access.redhat.com/errata/RHSA-2017:2709
- http://www.securityfocus.com/bid/92630
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499
- https://www.tenable.com/security/tns-2016-21
- https://kc.mcafee.com/corporate/index?page=content&id=SB10171
- https://access.redhat.com/errata/RHSA-2017:3239
- https://www.exploit-db.com/exploits/42091/
- https://security.gentoo.org/glsa/201701-65
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- http://www.securitytracker.com/id/1036696
- https://security.netapp.com/advisory/ntap-20160915-0001/
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us
- https://security.gentoo.org/glsa/201707-01
- http://www.securityfocus.com/bid/95568
- https://access.redhat.com/errata/RHSA-2017:3114
- https://bto.bluecoat.com/security-advisory/sa133
- https://www.tenable.com/security/tns-2017-09
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116
- https://access.redhat.com/errata/RHSA-2017:1216
- https://wiki.opendaylight.org/view/Security_Advisories
- https://access.redhat.com/errata/RHSA-2017:2710
- https://security.netapp.com/advisory/ntap-20170119-0001/
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984
- https://www.ietf.org/mail-archive/web/tls/current/msg04560.html
- https://access.redhat.com/errata/RHSA-2018:2123
- http://rhn.redhat.com/errata/RHSA-2017-0337.html
- https://access.redhat.com/errata/RHSA-2017:2708
- http://rhn.redhat.com/errata/RHSA-2017-0336.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388
- http://rhn.redhat.com/errata/RHSA-2017-0462.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- https://kc.mcafee.com/corporate/index?page=content&id=SB10215
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html
- http://www.securityfocus.com/archive/1/540341/100/0/threaded
- http://www.ubuntu.com/usn/USN-3087-1
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html
- +87 more
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2016-3268
- GCVE · GCVE-0-2016-2183
CERT-FR advisories
- CERTFR-2025-AVI-0854 — Vulnérabilité dans les produits Moxa · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0018 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0027 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0002 — Multiples vulnérabilités dans Moxa OnCell G3150A-LTE Series · cert.ssi.gouv.fr
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
- CERTFR-2022-AVI-1094 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2019-AVI-049 — Vulnérabilité dans Fortinet · cert.ssi.gouv.fr
- CERTFR-2019-AVI-014 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2017-AVI-226 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr
- CERTFR-2017-AVI-017 — Multiples vulnérabilités dans Oracle Java SE · cert.ssi.gouv.fr
- CERTFR-2016-AVI-351 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
- CERTFR-2016-AVI-350 — Multiples vulnérabilités dans Oracle Linux and Virtualization · cert.ssi.gouv.fr
- CERTFR-2016-AVI-320 — Multiples vulnérabilités dans OpenSSL · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_web_server:3.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*≥ 2.7.0 < 2.7.13cpe:2.3:a:python:python:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.7cpe:2.3:a:python:python:*:*:*:*:*:*:*:*≥ 3.5.0 < 3.5.3cpe:2.3:a:cisco:content_security_management_appliance:9.6.6-068:*:*:*:*:*:*:*cpe:2.3:a:cisco:content_security_management_appliance:9.7.0-006:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.1t:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*cpe:2.3:a:oracle:database:11.2.0.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:*:*:*:*- +5 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |