CVE-2016-3099

Impact:
Low
Public Date:
2016-04-05
CWE:
CWE-392
Bugzilla:
1319052: CVE-2016-3099 mod_nss: Invalid handling of +CIPHER operator
A flaw was found in the way mod_nss parsed certain OpenSSL-style cipher strings. As a result, mod_nss could potentially use ciphers that were not intended to be enabled.

Find out more about CVE-2016-3099 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 1.9
Base Metrics AV:L/AC:M/Au:N/C:N/I:P/A:N
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 7 (mod_nss) RHSA-2016:2602 2016-11-03

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 6 mod_nss Will not fix
Red Hat Enterprise Linux 5 mod_nss Will not fix
Red Hat Certificate System 8 mod_nss Will not fix

Acknowledgements

This issue was discovered by Rob Crittenden (Red Hat).
Last Modified