Advisory details:
apache_httpd / CVE-2016-0736
| Advisory ID | apache_httpd/CVE-2016-0736 |
| Aliases | |
| Summary | Prior to Apache HTTP release 2.4.25, mod_sessioncrypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC. An authentication tag (SipHash MAC) is now added to prevent such attacks. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| apache_httpd | low |
| Reference id | Reference type | URL |
|---|---|---|
| CVE-2016-0736 | https://httpd.apache.org/security/json/CVE-2016-0736.json |
| Data source | Exploit-DB |
|---|---|
| Date added | Dec. 23, 2016 |
| Description | Apache mod_session_crypto - Padding Oracle |
| Ransomware campaign use | Unknown |
| Source publication date | Dec. 23, 2016 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | Dec. 23, 2016 |
| Source URL | https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.