CVE-2016-2183
43Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 96%
probabilidade de exploração
96%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
O que os fabricantes declaram (VEX)
Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.
Red Hatdocumento VEX ↗
Afetado
10 produtos (26 componentes)
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 5 · Red Hat JBoss Enterprise Web Server 1 · Red Hat JBoss Enterprise Web Server 3 · e outros 5
workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5…
Corrigido
45 produtos (1.036 componentes)
Red Hat OpenShift Container Platform 3.11 · Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server · Red Hat Enterprise Linux Server Supplementary (v. 7) · e outros 40
Não afetado
6 produtos (749 componentes) — porque o código vulnerável não está presente no produto
Red Hat OpenShift Container Platform 4.8 · Red Hat OpenShift Container Platform 4.6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5 · e outros 1
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
n/a · n/aReferências
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html