CVE-2016-2183
43Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 96%
exploitation probability
96%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
10 products (26 components)
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 5 · Red Hat JBoss Enterprise Web Server 1 · Red Hat JBoss Enterprise Web Server 3 · and others 5
workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5…
Fixed
45 products (1,036 components)
Red Hat OpenShift Container Platform 3.11 · Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server · Red Hat Enterprise Linux Server Supplementary (v. 7) · and others 40
Not affected
6 products (749 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 4.8 · Red Hat OpenShift Container Platform 4.6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5 · and others 1
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/aReferences
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html