Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2016-0701 Details

Description

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:3.7 LOWVector:CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html	CVE
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759	CVE
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html	CVE
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html	CVE
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf	CVE
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=878e2c5b13010329c203f309ed0c8f2113f85648	CVE
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c5b831f21d0d29d1e517d139d9d101763f60c9a2	CVE
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us	CVE
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821	CVE
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893	CVE
https://security.gentoo.org/glsa/201601-05	CVE
https://www.kb.cert.org/vuls/id/257823	CVE
https://www.oracle.com/security-alerts/cpuapr2020.html	CVE
https://www.oracle.com/security-alerts/cpujan2020.html	CVE
https://www.oracle.com/security-alerts/cpujul2020.html	CVE
https://www.oracle.com/security-alerts/cpuoct2020.html	CVE
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	CVE
http://www.openssl.org/news/secadv/20160128.txt	CVE	Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	CVE
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	CVE
http://www.securityfocus.com/bid/82233	CVE
http://www.securityfocus.com/bid/91787	CVE
http://www.securitytracker.com/id/1034849	CVE
http://www.ubuntu.com/usn/USN-2883-1	CVE
http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html	[email protected]
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759	[email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html	[email protected]
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html	[email protected]
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf	[email protected]
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=878e2c5b13010329c203f309ed0c8f2113f85648	[email protected]
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c5b831f21d0d29d1e517d139d9d101763f60c9a2	[email protected]
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us	[email protected]
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821	[email protected]
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893	[email protected]
https://security.gentoo.org/glsa/201601-05	[email protected]
https://www.kb.cert.org/vuls/id/257823	[email protected]
https://www.oracle.com/security-alerts/cpuapr2020.html	[email protected]
https://www.oracle.com/security-alerts/cpujan2020.html	[email protected]
https://www.oracle.com/security-alerts/cpujul2020.html	[email protected]
https://www.oracle.com/security-alerts/cpuoct2020.html	[email protected]
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	[email protected]
http://www.openssl.org/news/secadv/20160128.txt	[email protected]	Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	[email protected]
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	[email protected]
http://www.securityfocus.com/bid/82233	[email protected]
http://www.securityfocus.com/bid/91787	[email protected]
http://www.securitytracker.com/id/1034849	[email protected]
http://www.ubuntu.com/usn/USN-2883-1	[email protected]

see all 48 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	[email protected]

Affected Products

Product	Versions
openssl openssl	1.0.2 1.0.2 beta1 1.0.2 beta2 1.0.2 beta3 1.0.2a
CPE cpe:2.3:a:openssl:openssl:1.0.2:::::::* cpe:2.3:a:openssl:openssl:1.0.2:beta1:::::: cpe:2.3:a:openssl:openssl:1.0.2:beta2:::::: cpe:2.3:a:openssl:openssl:1.0.2:beta3:::::: cpe:2.3:a:openssl:openssl:1.0.2a:::::::* cpe:2.3:a:openssl:openssl:1.0.2b:::::::* cpe:2.3:a:openssl:openssl:1.0.2c:::::::* cpe:2.3:a:openssl:openssl:1.0.2d:::::::* cpe:2.3:a:openssl:openssl:1.0.2e:::::::* Remediation No remediation found in references.

Product

Versions

openssl openssl

1.0.2

1.0.2 beta1

1.0.2 beta2

1.0.2 beta3

1.0.2a

CPE

cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

25 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
May 6, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 12, 2023	CVE Modified	[email protected]
Dec 13, 2022	CVE Modified	[email protected]
Oct 20, 2020	CVE Modified	[email protected]
Jul 15, 2020	CVE Modified	[email protected]
Apr 15, 2020	CVE Modified	[email protected]
Jan 15, 2020	CVE Modified	[email protected]
Jul 23, 2019	CVE Modified	[email protected]
Dec 13, 2017	CVE Modified	[email protected]
Dec 11, 2017	CVE Modified	[email protected]
Oct 20, 2017	CVE Modified	[email protected]
May 10, 2017	CVE Modified	[email protected]
May 9, 2017	CVE Modified	[email protected]
Dec 28, 2016	CVE Modified	[email protected]
Dec 6, 2016	CVE Modified	[email protected]
Dec 3, 2016	CVE Modified	[email protected]
Nov 28, 2016	CVE Modified	[email protected]
Aug 9, 2016	CVE Modified	[email protected]
Jul 22, 2016	CVE Modified	[email protected]
Jun 11, 2016	CVE Modified	[email protected]
Mar 11, 2016	Modified Analysis	[email protected]
Mar 9, 2016	Initial Analysis	[email protected]