CVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - secalert@redhat.com
- Published
- 2016-09-01
- Last modified
- 2026-05-29
- Weaknesses
- CWE-200
Affected products
- Content Security Management Appliance (Cisco)
- Node.js (Nodejs)
- Openssl (Openssl)
- Database (Oracle)
- Python (Python)
- Enterprise Linux (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Web Server (Redhat)
- Jboss Web Server (Redhat)
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html
- http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.html
- http://rhn.redhat.com/errata/RHSA-2017-0336.html
- http://rhn.redhat.com/errata/RHSA-2017-0337.html
- http://rhn.redhat.com/errata/RHSA-2017-0338.html
- http://rhn.redhat.com/errata/RHSA-2017-0462.html
- http://seclists.org/fulldisclosure/2017/Jul/31
- http://seclists.org/fulldisclosure/2017/May/105
- http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697
- http://www-01.ibm.com/support/docview.wss?uid=swg21991482
- http://www-01.ibm.com/support/docview.wss?uid=swg21995039
