CVE-2016-7056
- State
- Published
- Severity
- 5.5 Medium
- Published
- Sep 10, 2018
- Updated
- Aug 6, 2024
- Reserved
- Aug 23, 2016
Description
A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.5 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
opensslThe OpenSSL Project |
|
References
- https://eprint.iacr.org/2016/1195
- RHSA-2017:1801vendor-advisory
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008
- RHSA-2017:1413vendor-advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig
- 1037575vdb-entry
- RHSA-2017:1414vendor-advisory
- [oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL)mailing-list
- DSA-3773vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056
- https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html
- 95375vdb-entry
- RHSA-2017:1415vendor-advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig
- https://security-tracker.debian.org/tracker/CVE-2016-7056
- RHSA-2017:1802vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.