NetSight
IP …
medium5.5

CVE-2016-2178

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it eas…

Impact

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

Affected products

VendorProductAffected versions
OpensslOpenssl
Versions 1.0.1, 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, 1.0.1e
OracleLinux
Versions 5, 6, 7
OracleSolaris
Versions 10, 11.3
SuseLinux Enterprise
Version 12.0
NodejsNode.Js
from 0.10.0 before 0.10.47
from 0.12.0 before 0.12.16
from 4.0.0 through 4.1.2
from 4.2.0 before 4.6.0
from 5.0.0 before 6.7.0
DebianDebian Linux
Version 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04

Weakness classification

CWE-203

References