CVE-2016-0800

CVE-2016-0800

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

CVSS 5.9 · Medium · EPSS 82.1% · Public exploit · Fix available

Published

2016-03-01T00:00:00.000Z

Updated

2024-08-05T22:30:05.111Z

Stack: system · network

Check your server →