VRT
391,192 CVEs tracked ·
15,442 in RASP scope ·
data as of 20 hours ago
VRT
391,192 CVEs tracked ·
15,442 in RASP scope ·
data as of 20 hours ago
CVE-2016-2107The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
CWE-200 · Information exposureCWE-310
Working exploit published
A reviewed exploit catalogue carries this CVE. Somebody has published code a stranger can run.
CVSS E:P
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Simple test for the May 2016 OpenSSL padding oracle (CVE-2016-2107) | 193 | 2016-05-03 |
| GitHub PoC | Docker container implementing tests for CVE-2016-2107 - LuckyNegative20 | 2 | 2016-06-09 |
| Exploit-DB | OpenSSL - Padding Oracle in AES-NI CBC MAC Check | 2016-05-04 |
Not a Java vulnerability. Outside ARMR's domain entirely.
| Decided by | manual classification : Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | Historical classification excluded this CVE and no tracked product appears on the record, so it is not a Java problem ARMR was ever asked to address. |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2 metrics
VRT selects the newest version's highest entry and
publishes it as cvssScore, newest rather than largest because scores are not comparable
across versions, and highest rather than first because the first entry is frequently a CNA placeholder
scoring 0.0 over NVD's own analysis.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 2.6 | no band published | AV:N/AC:H/Au:N/C:P/I:N/A:N |
NVD | Primary |
| Advisory | Type | Quarter | Products Oracle named in risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2018 ↗ | CPU | 2018-Q4 | Oracle Communications Applications / Security (OpenSSL) (Prior to 3.7.1M0) |
| Oracle Critical Patch Update January 2018 ↗ | CPU | 2018-Q1 | Oracle Fusion Middleware / Internal Development (OpenSSL) (3.0.1) |
| Oracle Critical Patch Update October 2017 ↗ | CPU | 2017-Q4 | Oracle Communications Applications / Security (OpenSSL) (7.0, 7.1, 7.2) |
| Oracle Critical Patch Update July 2017 ↗ | CPU | 2017-Q3 | Oracle Communications Applications / Platform (OpenSSL) (10.0) Oracle Communications Applications / Routing (OpenSSL) (PCZ210) Oracle Communications Applications / Routing (OpenSSL) (SCZ730, SCZ740, ECZ730) |
| Oracle Critical Patch Update April 2017 ↗ | CPU | 2017-Q2 | Oracle Commerce / Platform Services (6.1.4, 11.0, 11.1, 11.2) |
| Oracle Critical Patch Update October 2016 ↗ | CPU | 2016-Q4 | Oracle Commerce / MDEX (6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1, 6.5.2) Oracle Communications Applications / OpenSSL (Ecz7.3m1p4 and earlier) Oracle Enterprise Manager Grid Control / Ops Center (12.1.4, 12.2.2, 12.3.2) Oracle Fusion Middleware / Installation (11.1.1.7.0, 11.1.1.9.0, 12.1.1.0.0, 12.2.1.1.0) Oracle Health Sciences Applications / OpenSSL (2.x) Oracle Primavera Products Suite / OpenSSL (8.3, 8.4, 15.x, 16.x) Oracle Supply Chain Products Suite / Install (6.1, 6.2) Oracle Virtualization / OpenSSL (SROS prior to 11.1.7) |
| Oracle Critical Patch Update July 2016 ↗ | CPU | 2016-Q3 | Oracle Communications Applications / Routing (7.2.5, 7.3.5) Oracle Enterprise Manager Grid Control / Discovery Framework (12.1.0.5, 13.1.0.0) Oracle Fusion Middleware / Base Image (1.x, 2.x) Oracle Fusion Middleware / Web Server Plugin (10.1.4.x, 11.1.1.7) Oracle PeopleSoft Products / Security (8.53, 8.54, 8.55) Oracle Supply Chain Products Suite / Install (6.1.3.0, 6.2.0.0) |
| Family | Component | Oracle's version cell (verbatim) | Indexed as |
|---|---|---|---|
| Oracle Commerce | MDEX | 6.2.2, 6.3.0, 6.4.1.2, 6.5.0, 6.5.1, 6.5.2 | 6.2.2 · 6.3.0 · 6.4.1.2 · 6.5.0 · 6.5.1 · 6.5.2 |
| Oracle Commerce | Platform Services | 6.1.4, 11.0, 11.1, 11.2 | 6.1.4 · 11.0 · 11.1 · 11.2 |
| Oracle Communications Applications | OpenSSL | Ecz7.3m1p4 and earlier | |
| Oracle Communications Applications | Platform (OpenSSL) | 10.0 | 10.0 |
| Oracle Communications Applications | Routing | 7.2.5, 7.3.5 | 7.2.5 · 7.3.5 |
| Oracle Communications Applications | Routing (OpenSSL) | PCZ210 | |
| Oracle Communications Applications | Security (OpenSSL) | Prior to 3.7.1M0 | 7.0 · 7.1 · 7.2 |
| Oracle Enterprise Manager Grid Control | Discovery Framework | 12.1.0.5, 13.1.0.0 | 12.1.0.5 · 13.1.0.0 |
| Oracle Enterprise Manager Grid Control | Ops Center | 12.1.4, 12.2.2, 12.3.2 | 12.1.4 · 12.2.2 · 12.3.2 |
| Oracle Fusion Middleware | Base Image | 1.x, 2.x | 1 · 2 |
| Oracle Fusion Middleware | Installation | 11.1.1.7.0, 11.1.1.9.0, 12.1.1.0.0, 12.2.1.1.0 | 11.1.1.7.0 · 11.1.1.9.0 · 12.1.1.0.0 · 12.2.1.1.0 |
| Oracle Fusion Middleware | Internal Development (OpenSSL) | 3.0.1 | 3.0.1 |
| Oracle Fusion Middleware | Web Server Plugin | 10.1.4.x, 11.1.1.7 | 10.1.4 · 11.1.1.7 |
| Oracle Health Sciences Applications | OpenSSL | 2.x | 2 |
| Oracle PeopleSoft Products | Security | 8.53, 8.54, 8.55 | 8.53 · 8.54 · 8.55 |
| Oracle Primavera Products Suite | OpenSSL | 8.3, 8.4, 15.x, 16.x | 8.3 · 8.4 · 15 · 16 |
| Oracle Supply Chain Products Suite | Install | 6.1, 6.2 | 6.1 · 6.1.3.0 · 6.2 · 6.2.0.0 |
| Oracle Virtualization | OpenSSL | SROS prior to 11.1.7 | 11.1.7 |
| Source | Vendor | Product | Scheme | Affected Versions |
|---|---|---|---|---|
| nvd | canonical | ubuntu linux | generic | 12.04 · 14.04 · 15.10 · 16.04 |
| nvd | debian | debian linux | generic | 8.0 |
| nvd | android | generic | 4.0 · 4.0.1 · 4.0.2 · 4.0.3 · 4.0.4 · 4.1 · 4.1.2 · 4.2 · 4.2.1 · 4.2.2 · 4.3 · 4.3.1 · 4.4 · 4.4.1 · 4.4.2 · 4.4.3 · 5.0 · 5.0.1 · 5.1 · 5.1.0 | |
| nvd | hp | helion openstack | generic | 2.0.0 · 2.1.0 · 2.1.2 · 2.1.4 |
| nvd | nodejs | node.js | generic | ≥ 0.10.0 and ＜ 0.10.45 · ≥ 0.12.0 and ＜ 0.12.14 · ≥ 4.0.0 and ≤ 4.1.2 · ≥ 4.2.0 and ＜ 4.4.4 · ≥ 5.0.0 and ＜ 5.11.1 · 6.0.0 |
| nvd | openssl | openssl | generic | ≤ 1.0.1 · 1.0.2 · 1.0.2:beta1 · 1.0.2:beta2 · 1.0.2:beta3 · 1.0.2a · 1.0.2b · 1.0.2c · 1.0.2d · 1.0.2e · 1.0.2f · 1.0.2g |
| nvd | opensuse | leap | generic | 42.1 |
| nvd | opensuse | opensuse | generic | 13.2 |
| nvd | redhat | enterprise linux desktop | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux hpc node | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux hpc node eus | generic | 7.2 |
| nvd | redhat | enterprise linux server | generic | 6.0 · 7.0 |
| nvd | redhat | enterprise linux server aus | generic | 7.2 |
| nvd | redhat | enterprise linux server eus | generic | 7.2 |
| nvd | redhat | enterprise linux workstation | generic | 6.0 · 7.0 |
A reviewer manually classified this CVE. The retained record includes the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, SECURITY (OPENSSL), INSTALL, SSL, OPS CENTER, MULTIPLE, NO AUTH REMOTE EXPLOIT, PLATFORM SERVICES, ROUTING, WEB SERVER PLUGIN, MDEX, DISCOVERY FRAMEWORK, BASE IMAGE, PLATFORM (OPENSSL), ROUTING (OPENSSL), INTERNAL DEVELOPMENT (OPENSSL), HTTPS, TLS, SSL/TLS, INSTALLATION, SECURITY, OPENSSL **Products:** SUN RAY OPERATING SOFTWARE, ORACLE COMMUNICATIONS WEBRTC SESSION CONTROLLER, ORACLE COMMERCE, ORACLE EXALOGIC INFRASTRUCTURE, ORACLE AGILE ENGINEERING DATA MANAGEMENT, ORACLE ACCESS MANAGER, ORACLE ENTERPRISE SESSION BORDER CONTROLLER, ORACLE ENTERPRISE COMMUNICATIONS BROKER, ORACLE ENTERPRISE MANAGER GRID CONTROL, ORACLE COMMUNICATIONS SESSION ROUTER, ENTERPRISE MANAGER BASE PLATFORM, ORACLE COMMUNICATIONS APPLICATION SESSION CONTROLLER, ORACLE BUSINESS INTELLIGENCE ENTERPRISE EDITION, ORACLE COMMUNICATIONS UNIFIED SESSION MANAGER, ORACLE VIRTUALIZATION, ORACLE COMMUNICATIONS EAGLE LNP APPLICATION PROCESSOR, ORACLE FUSION MIDDLEWARE, ORACLE LIFE SCIENCES DATA HUB, ORACLE COMMERCE GUIDED SEARCH / ORACLE COMMERCE EXPERIENCE MANAGER, ORACLE PEOPLESOFT PRODUCTS, PRIMAVERA P6 PROFESSIONAL PROJECT MANAGEMENT, ORACLE SUPPLY CHAIN PRODUCTS SUITE, ORACLE PRIMAVERA PRODUCTS SUITE, PEOPLESOFT ENTERPRISE PEOPLETOOLS, OPENSSL, ORACLE MOBILE SECURITY SUITE, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE TRANSPORTATION MANAGEMENT, ORACLE HEALTH SCIENCES APPLICATIONS, ENTERPRISE MANAGER
| Published | 2016-05-05 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |