CVE-2016-0701

    Dashboard / Vulnerabilities / CVE-2016-0701

    CVE-2016-0701

    Published: 15 Feb 2016Last Modified: 8 Jul 2026

    Summary:

    Details: The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

    References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759, http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html, http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html, http://www.securityfocus.com/bid/82233, http://www.securityfocus.com/bid/91787, http://www.securitytracker.com/id/1034849, https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf, https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=878e2c5b13010329c203f309ed0c8f2113f85648, https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c5b831f21d0d29d1e517d139d9d101763f60c9a2, https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us, https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821, https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893, https://www.kb.cert.org/vuls/id/257823, https://www.oracle.com/security-alerts/cpuapr2020.html, https://www.oracle.com/security-alerts/cpujan2020.html, https://www.oracle.com/security-alerts/cpujul2020.html, https://www.oracle.com/security-alerts/cpuoct2020.html, http://www.openssl.org/news/secadv/20160128.txt, http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html, http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html, http://www.ubuntu.com/usn/USN-2883-1, https://security.gentoo.org/glsa/201601-05, https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html, http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4ac0329582829f5378d8078c8d314ad37db87736
    Fixed -95605f3ae1ec8857e8cb612ce35805a3b0207d21

    Affected versions

    1.0.2
    1.0.2-beta1
    1.0.2-beta2
    1.0.2-beta3
    1.0.2a
    1.0.2b
    1.0.2c
    1.0.2d
    1.0.2e

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2016-0701 | CVE-DB