UpHeron
All vulnerabilities

Servers and applications

CVE-2016-2178

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

Severity
Medium 5.5
Published
20 Jun 2016
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
0.10.47, 0.12.16, 4.6.0, 6.7.0
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 0.10.0 before 0.10.47
  • From 0.12.0 before 0.12.16
  • From 4.0.0 up to 4.1.2
  • From 4.2.0 before 4.6.0
  • From 5.0.0 before 6.7.0
OpenSSLServers and applications · cpe:a:openssl:openssl
  • Version 1.0.2h
  • Version 1.0.2g
  • Version 1.0.2f
  • Version 1.0.2e
All 30 release lines
  • Version 1.0.1
  • Version 1.0.1a
  • Version 1.0.1b
  • Version 1.0.1c
  • Version 1.0.1d
  • Version 1.0.1e
  • Version 1.0.1f
  • Version 1.0.1g
  • Version 1.0.1h
  • Version 1.0.1i
  • Version 1.0.1j
  • Version 1.0.1k
  • Version 1.0.1l
  • Version 1.0.1m
  • Version 1.0.1n
  • Version 1.0.1o
  • Version 1.0.1p
  • Version 1.0.1q
  • Version 1.0.1r
  • Version 1.0.1s
  • Version 1.0.1t
  • Version 1.0.2
  • Version 1.0.2a
  • Version 1.0.2b
  • Version 1.0.2c
  • Version 1.0.2d
  • Version 1.0.2e
  • Version 1.0.2f
  • Version 1.0.2g
  • Version 1.0.2h

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-2178
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-2178