The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain the shared secret.
References
| Link | Resource |
|---|---|
| http://www.dest-unreach.org/socat/contrib/socat-secadv7.html | Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/02/01/4 | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/02/04/1 | Third Party Advisory |
| https://security.gentoo.org/glsa/201612-23 | |
| http://www.dest-unreach.org/socat/contrib/socat-secadv7.html | Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/02/01/4 | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/02/04/1 | Third Party Advisory |
| https://security.gentoo.org/glsa/201612-23 |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.dest-unreach.org/socat/contrib/socat-secadv7.html - Patch, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2016/02/01/4 - Mailing List, Patch, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2016/02/04/1 - Third Party Advisory | |
| References | () https://security.gentoo.org/glsa/201612-23 - |
Information
Published : 2017-01-30 22:59
Updated : 2024-11-21 02:48
NVD link : CVE-2016-2217
Mitre link : CVE-2016-2217
CVE.ORG link : CVE-2016-2217
JSON object : View
Products Affected
dest-unreach
- socat
CWE
CWE-320
Key Management Errors