Vulnerability Report

CVE-2016-2107

Title: Openssl Information Disclosure

Information Disclosure

Proof Of Concept

PoC Available for CVE-2016-2107

CWE Category CWE-200

Published Date May 05, 2016

Modified Date May 06, 2026

Exploit Status Available

Score 5.9 CVSS v3.1

Exploit Probability (EPSS)

79.96%

Vulnerability Summary

CVE-2016-2107: The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

Impacted Vendors

Reference Links

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html http://rhn.redhat.com/errata/RHSA-2016-0722.html http://rhn.redhat.com/errata/RHSA-2016-0996.html http://rhn.redhat.com/errata/RHSA-2016-2073.html http://rhn.redhat.com/errata/RHSA-2016-2957.html http://source.android.com/security/bulletin/2016-07-01.html http://support.citrix.com/article/CTX212736 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html http://www.debian.org/security/2016/dsa-3566 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://www.securityfocus.com/bid/89760 http://www.securityfocus.com/bid/91787 http://www.securitytracker.com/id/1035721 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103 http://www.ubuntu.com/usn/USN-2959-1 https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/ https://bto.bluecoat.com/security-advisory/sa123 https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=68595c0c2886e7942a14f98c17a55a88afb6c292 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03728en_us https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202 https://kc.mcafee.com/corporate/index?page=content&id=SB10160 https://security.gentoo.org/glsa/201612-16 https://security.netapp.com/advisory/ntap-20160504-0001/ https://support.apple.com/HT206903 https://www.exploit-db.com/exploits/39768/ https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc https://www.openssl.org/news/secadv/20160503.txt https://www.tenable.com/security/tns-2016-18 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00019.html http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html http://rhn.redhat.com/errata/RHSA-2016-0722.html http://rhn.redhat.com/errata/RHSA-2016-0996.html http://rhn.redhat.com/errata/RHSA-2016-2073.html http://rhn.redhat.com/errata/RHSA-2016-2957.html http://source.android.com/security/bulletin/2016-07-01.html http://support.citrix.com/article/CTX212736 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html http://www.debian.org/security/2016/dsa-3566 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://www.securityfocus.com/bid/89760 http://www.securityfocus.com/bid/91787 http://www.securitytracker.com/id/1035721 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103 http://www.ubuntu.com/usn/USN-2959-1 https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/ https://bto.bluecoat.com/security-advisory/sa123 https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=68595c0c2886e7942a14f98c17a55a88afb6c292 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03728en_us https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03756en_us https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03765en_us https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202 https://kc.mcafee.com/corporate/index?page=content&id=SB10160 https://security.gentoo.org/glsa/201612-16 https://security.netapp.com/advisory/ntap-20160504-0001/ https://support.apple.com/HT206903 https://www.exploit-db.com/exploits/39768/ https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc https://www.openssl.org/news/secadv/20160503.txt https://www.tenable.com/security/tns-2016-18

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.9

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity LOW

2.6

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:H/Au:N/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2016-2107 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/39768

View Code

May 06, 2026 MODIFIED

Vulnerability data updated via NVD.

April 12, 2025 MODIFIED

Vulnerability data or affected products updated.

May 05, 2016 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity HIGH

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Stack

No specific products linked.