CVE-2016-2183
High
Description
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
SeverityHigh
CVSS7.5
Exploit probability100. percentile94.7%
Product
Redhat Jboss Enterprise Application Platform
PublishedSep 1, 2016
First seenSep 1, 2016
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- python python2.7.13, 3.4.7, 3.5.3 or later
- nodejs node.js0.10.47, 0.12.16, 4.1.2, 4.6.0, 6.7.0 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2017:3113
- security.gentoo.org/glsa/201612-16
- access.redhat.com/errata/RHSA-2017:3240
- access.redhat.com/errata/RHSA-2017:2709
- access.redhat.com/errata/RHSA-2017:3239
- security.gentoo.org/glsa/201701-65
- security.gentoo.org/glsa/201707-01
- access.redhat.com/errata/RHSA-2017:3114
- access.redhat.com/errata/RHSA-2017:1216
- access.redhat.com/errata/RHSA-2017:2710
- access.redhat.com/errata/RHSA-2018:2123
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat jboss_enterprise_application_platform | 6.0.0 | — |
| redhat jboss_enterprise_web_server | 1.0.0, 2.0.0 | — |
| redhat jboss_web_server | 3.0 | — |
| redhat enterprise_linux | 5.0, 6.0, 7.0 | — |
| python python | 2.7.0 ≤ v < 2.7.13, 3.4.0 ≤ v < 3.4.7, 3.5.0 ≤ v < 3.5.3 | 2.7.13, 3.4.7, 3.5.3 |
| cisco content_security_management_appliance | 9.6.6-068, 9.7.0-006 | — |
| openssl openssl | 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, 1.0.1e, 1.0.1f, 1.0.1g, 1.0.1h, 1.0.1i, 1.0.1j, 1.0.1k, 1.0.1l, 1.0.1m, 1.0.1n, 1.0.1o, 1.0.1p, 1.0.1q, 1.0.1r, 1.0.1t, 1.0.2a, 1.0.2b, 1.0.2c, 1.0.2d, 1.0.2e, 1.0.2f, 1.0.2h | — |
| oracle database | 11.2.0.4, 12.1.0.2 | — |
| nodejs node.js | 0.10.0 ≤ v < 0.10.47, 0.12.0 ≤ v < 0.12.16, 4.0.0 ≤ v < 4.1.2, 4.2.0 ≤ v < 4.6.0, 6.0.0 ≤ v < 6.7.0 | 0.10.47, 0.12.16, 4.1.2, 4.6.0, 6.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.