Уязвимость CVE-2016-0701: Информация

Описание

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

Важность: LOW (3,7) Вектор: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Исправленные пакеты

Ссылки на рекомендации, решения и инструменты

1. Подверженные конфигурации:

   1. Конфигурация 1

      cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*

      ---

      cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*

      ---