Published: 08/06/2017 Updated: 13/02/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote malicious users to force the use of ciphers that were not intended to be enabled.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 7.0

Synopsis Low: mod_nss security, bug fix, and enhancement update Type/Severity Security Advisory: Low Topic An update for mod_nss is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) bas ...

Debian Bug report logs - #822461 libapache2-mod-nss: CVE-2016-3099: Invalid handling of +CIPHER operator Package: src:libapache2-mod-nss; Maintainer for src:libapache2-mod-nss is Debian 389ds Team <pkg-fedora-ds-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 24 A ...

It was reported that +CIPHER operator in OpenSSL changes the order of a cipher Instead of returning an error (as NSS does not support cipher ordering), it returned the result of processing up to that point, which could result in requested ciphers not being enabled ...

A flaw was found in the way mod_nss parsed certain OpenSSL-style cipher strings As a result, mod_nss could potentially use ciphers that were not intended to be enabled ...

CWE-327 https://bugzilla.redhat.com/show_bug.cgi?id=1319052 http://rhn.redhat.com/errata/RHSA-2016-2602.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184345.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183129.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183102.html https://access.redhat.com/errata/RHSA-2016:2602 https://nvd.nist.gov https://alas.aws.amazon.com/ALAS-2016-714.html

CVE-2016-3099

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect