Homepage

Cryptographic Issues The advisory has been revoked - it doesn't affect any version of package openssl098  (opens in a new tab)

Threat Intelligence

EPSS
82.11% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1504-OPENSSL098-623384
  • published10 Sept 2020
  • disclosed1 Mar 2016
Report a new vulnerability Found a mistake?

Introduced: 1 Mar 2016

CVE-2016-0800  (opens in a new tab)
CWE-310  (opens in a new tab)
CWE-200  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:15.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl098 package and not the openssl098 package as distributed by Ubuntu.

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

References