CVE-2016-2107
MediumPublic exploitThe AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session.
Published May 5, 2016 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2016-2107, DEBIAN-CVE-2016-2107, UBUNTU-CVE-2016-2107
Key Facts
Patch immediately- CVE-2016-2107 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Helion Openstack (Hp), Node.js (Nodejs), Openssl and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 89% probability of exploitation in the next 30 days.
- Fixed versions are available, including libopenssl-1_1-devel 1.1.1l-1.2, libopenssl-1_1-devel-32bit 1.1.1l-1.2, libopenssl-devel 1.0.1i-15.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
89%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2016-2107 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
Affected Products
192 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Helion OpenstackHp | 2.0.0, 2.1.0, 2.1.2, 2.1.4 | n/a |
| Node.jsNodejs | 6.0.0 | 0.10.45 |
| OpensslOpenssl | 1.0.2, 1.0.2a, 1.0.2b, 1.0.2-beta1, 1.0.2-beta2, 1.0.2-beta3, 1.0.2c, 1.0.2d | 1.0.1s |
| Ubuntu LinuxCanonical | 12.04, 14.04, 15.10, 16.04 | n/a |
| Debian LinuxDebian | 8.0 | n/a |
Patched Releases
libopenssl-1_1-devel
1.1.1l-1.2
libopenssl-1_1-devel-32bit
1.1.1l-1.2
libopenssl-devel
1.0.1i-15.1, 1.0.1i-27.16.1, 1.0.1i-47.1, 1.0.1k-2.36.1, 1.0.2j-2.2
libopenssl-devel-32bit
1.0.1i-15.1, 1.0.1k-2.36.1, 1.0.2j-2.2
libopenssl1_0_0
1.0.1g-0.47.1, 1.0.1i-15.1, 1.0.1i-27.16.1, 1.0.1i-47.1, 1.0.1k-2.36.1, 1.0.2j-2.2
libopenssl1_0_0-32bit
1.0.1g-0.47.1, 1.0.1i-15.1, 1.0.1i-27.16.1, 1.0.1i-47.1, 1.0.1k-2.36.1, 1.0.2j-2.2
libopenssl1_0_0-debuginfo
1.0.1k-2.36.1
libopenssl1_0_0-debuginfo-32bit
1.0.1k-2.36.1
libopenssl1_0_0-hmac
1.0.1i-15.1, 1.0.1i-27.16.1, 1.0.1i-47.1, 1.0.1k-2.36.1, 1.0.2j-2.2
libopenssl1_0_0-hmac-32bit
1.0.1i-15.1, 1.0.1i-27.16.1, 1.0.1i-47.1, 1.0.1k-2.36.1, 1.0.2j-2.2
libopenssl1_0_0-steam
1.0.2h-4.1
libopenssl1_0_0-steam-32bit
1.0.2h-4.1
libopenssl1_0_0-x86
1.0.1g-0.47.1
libopenssl1_1
1.1.1l-1.2
libopenssl1_1-32bit
1.1.1l-1.2
libopenssl1_1-hmac
1.1.1l-1.2
libopenssl1-devel
1.0.1g-0.47.1
nodejs
4.4.5-27.1
Node.js
0.10.45, 4.1.2, 4.4.4
nodejs-devel
4.4.5-27.1
nodejs-docs
4.4.5-27.1
npm
4.4.5-27.1
Openssl
0:1.0.1e-42.el6_7.5, 1:1.0.1e-51.el7_2.5, 1:1.0.1k-14.91.amzn1, 1.0.1e-2+deb7u21, 1.0.1e-48.el6_8.1, 1.0.1e-59.el6_10+sp999, 1.0.1f-1ubuntu2.19, 1.0.1i-15.1, 1.0.1i-27.16.1, 1.0.1i-47.1, 1.0.1k-2.36.1, 1.0.1k-3+deb8u5, 1.0.2g-1ubuntu4.1, 1.0.2h-1, 1.0.2h-r0, 1.0.2j-2.2, 2:1.0.1e-48.ksplice1.el6_8.1, 2:1.0.1e-51.ksplice1.el7_2.5, 1.0.1s
openssl-1_1
1.1.1l-1.2
openssl-1_1-doc
1.1.1l-1.2
Timeline
Publicly disclosed
May 5, 2016
Last updated
Aug 4, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-310
References
- advisoryhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- advisoryAPPLE-SA-2016-07-18-1
- advisoryFEDORA-2016-05c567df1a
- advisoryFEDORA-2016-1411324654
- advisoryFEDORA-2016-1e39d934ed
FAQ
Common Questions.
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session.
Affected: Helion Openstack (Hp) versions 2.0.0, 2.1.0, 2.1.2, 2.1.4; Node.js (Nodejs) versions 6.0.0; Openssl versions 1.0.2, 1.0.2a, 1.0.2b, 1.0.2-beta1, 1.0.2-beta2, 1.0.2-beta3, 1.0.2c, 1.0.2d, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including libopenssl-1_1-devel 1.1.1l-1.2, libopenssl-1_1-devel-32bit 1.1.1l-1.2, libopenssl-devel 1.0.1i-15.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2016-2107 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo