Description

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

Remediation

References

CVE-2016-2178

Related Vulnerabilities

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Cross-Site Scripting (3.4.22.1)

WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.33)

MySQL CVE-2019-2486 Vulnerability (CVE-2019-2486)

WordPress Plugin KNR Author List Widget 'listItem[]' Parameter SQL Injection (2.0.0)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4303)

Severity

Medium

Classification

CVE-2016-2178 CWE-200 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities