2017-10-16 12:31:07 -04:00
{
2018-09-10 12:06:31 -04:00
"CVE_data_meta" : {
"ASSIGNER" : "anemec@redhat.com" ,
"ID" : "CVE-2016-7056" ,
"STATE" : "PUBLIC"
} ,
"affects" : {
"vendor" : {
"vendor_data" : [
2018-09-10 17:17:32 +02:00
{
2018-09-10 12:06:31 -04:00
"product" : {
"product_data" : [
{
"product_name" : "openssl" ,
"version" : {
"version_data" : [
{
"version_value" : "openssl 1.0.1u"
}
]
}
}
]
} ,
"vendor_name" : "The OpenSSL Project"
2018-09-10 17:17:32 +02:00
}
2018-09-10 12:06:31 -04:00
]
}
} ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
"description" : {
"description_data" : [
{
"lang" : "eng" ,
"value" : "A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys."
}
]
} ,
"impact" : {
"cvss" : [
[
2018-09-10 17:17:32 +02:00
{
2018-09-10 12:06:31 -04:00
"vectorString" : "5.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" ,
"version" : "3.0"
2018-09-10 17:17:32 +02:00
}
2018-09-10 12:06:31 -04:00
]
]
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-385"
}
2018-09-10 17:17:32 +02:00
]
2018-09-10 12:06:31 -04:00
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "[oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL)" ,
"refsource" : "MLIST" ,
"url" : "https://seclists.org/oss-sec/2017/q1/52"
} ,
{
"name" : "https://eprint.iacr.org/2016/1195" ,
"refsource" : "MISC" ,
"url" : "https://eprint.iacr.org/2016/1195"
} ,
{
"name" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056" ,
"refsource" : "CONFIRM" ,
"url" : "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056"
} ,
{
"name" : "https://git.openssl.org/?p=openssl.git;a=commit;h=8aed2a7548362e88e84a7feb795a3a97e8395008" ,
"refsource" : "CONFIRM" ,
"url" : "https://git.openssl.org/?p=openssl.git;a=commit;h=8aed2a7548362e88e84a7feb795a3a97e8395008"
2018-09-11 06:04:32 -04:00
} ,
2018-09-11 17:07:22 -04:00
{
"name" : "https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig" ,
"refsource" : "CONFIRM" ,
"url" : "https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig"
} ,
{
"name" : "https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig" ,
"refsource" : "CONFIRM" ,
"url" : "https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig"
} ,
{
"name" : "https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html" ,
"refsource" : "CONFIRM" ,
"url" : "https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html"
} ,
{
"name" : "https://security-tracker.debian.org/tracker/CVE-2016-7056" ,
"refsource" : "CONFIRM" ,
"url" : "https://security-tracker.debian.org/tracker/CVE-2016-7056"
} ,
2018-09-11 06:04:32 -04:00
{
"name" : "DSA-3773" ,
"refsource" : "DEBIAN" ,
"url" : "https://www.debian.org/security/2017/dsa-3773"
} ,
{
"name" : "RHSA-2017:1413" ,
"refsource" : "REDHAT" ,
"url" : "https://access.redhat.com/errata/RHSA-2017:1413"
} ,
{
"name" : "RHSA-2017:1414" ,
"refsource" : "REDHAT" ,
"url" : "https://access.redhat.com/errata/RHSA-2017:1414"
} ,
{
"name" : "RHSA-2017:1415" ,
"refsource" : "REDHAT" ,
"url" : "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
} ,
{
"name" : "RHSA-2017:1801" ,
"refsource" : "REDHAT" ,
"url" : "https://access.redhat.com/errata/RHSA-2017:1801"
} ,
{
"name" : "RHSA-2017:1802" ,
"refsource" : "REDHAT" ,
"url" : "https://access.redhat.com/errata/RHSA-2017:1802"
} ,
{
"name" : "95375" ,
"refsource" : "BID" ,
"url" : "http://www.securityfocus.com/bid/95375"
} ,
{
"name" : "1037575" ,
"refsource" : "SECTRACK" ,
"url" : "http://www.securitytracker.com/id/1037575"
2018-09-10 12:06:31 -04:00
}
]
}
2017-10-16 12:31:07 -04:00
}