CVE-2016-2178

Description

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.34%
Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory FreeBSD.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory cisco.com Vendor Advisory opensuse.org Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory debian.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory opensuse.org
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
https://www.tenable.com/security/tns-2016-20 third party advisory
http://www.splunk.com/view/SP-CAAAPUE third party advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html third party advisory patch
http://rhn.redhat.com/errata/RHSA-2017-1659.html third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/06/09/8 third party advisory mailing list
https://access.redhat.com/errata/RHSA-2017:1658 third party advisory vendor advisory
http://rhn.redhat.com/errata/RHSA-2016-1940.html third party advisory vendor advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html third party advisory
https://security.gentoo.org/glsa/201612-16 vdb entry third party advisory vendor advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312 third party advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us third party advisory
http://www.splunk.com/view/SP-CAAAPSV third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21995039 third party advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html third party advisory patch
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ third party advisory
https://www.tenable.com/security/tns-2016-16 third party advisory
https://www.tenable.com/security/tns-2016-21 third party advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html third party advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html third party advisory patch
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=399944622df7bd81af62e67ea967c470534090e2
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html third party advisory patch
http://www.securityfocus.com/bid/91081 vdb entry third party advisory
https://access.redhat.com/errata/RHSA-2017:0194 third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/06/08/2 mailing list third party advisory patch
https://access.redhat.com/errata/RHSA-2017:0193 third party advisory vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1343400 issue tracking patch
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html third party advisory
http://rhn.redhat.com/errata/RHSA-2016-2957.html third party advisory vendor advisory
https://bto.bluecoat.com/security-advisory/sa132 third party advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html third party advisory patch
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html third party advisory vendor advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448 third party advisory
http://www.securitytracker.com/id/1036054 vdb entry third party advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 third party advisory
http://eprint.iacr.org/2016/594.pdf third party advisory technical description
https://kc.mcafee.com/corporate/index?page=content&id=SB10215 third party advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html mailing list third party advisory vendor advisory
http://www.ubuntu.com/usn/USN-3087-1 third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html mailing list third party advisory vendor advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/06/08/8 third party advisory mailing list
http://www.openwall.com/lists/oss-security/2016/06/08/4 third party advisory mailing list
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html mailing list third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/06/08/6 third party advisory mailing list
https://support.f5.com/csp/article/K53084033 third party advisory
http://www.ubuntu.com/usn/USN-3087-2 third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html mailing list third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html mailing list third party advisory vendor advisory
http://seclists.org/fulldisclosure/2017/Jul/31 third party advisory mailing list
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html mailing list third party advisory vendor advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us third party advisory
http://www.openwall.com/lists/oss-security/2016/06/08/10 third party advisory mailing list
http://www.openwall.com/lists/oss-security/2016/06/08/11 third party advisory mailing list
http://www.openwall.com/lists/oss-security/2016/06/08/5 third party advisory mailing list
http://www.debian.org/security/2016/dsa-3673 third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html mailing list third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html mailing list third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/06/08/12 third party advisory mailing list
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html mailing list third party advisory vendor advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448 third party advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html mailing list third party advisory vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html mailing list third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/06/08/7 third party advisory mailing list
http://www.openwall.com/lists/oss-security/2016/06/09/2 third party advisory mailing list
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html mailing list third party advisory vendor advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en third party advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24 third party advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Frequently Asked Questions

What is the severity of CVE-2016-2178?
CVE-2016-2178 has been scored as a medium severity vulnerability.
How to fix CVE-2016-2178?
To fix CVE-2016-2178, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2016-2178 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2016-2178 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.