Back to search
CVE-2016-0736
Published: Jul 27, 2017
Modified: Sep 16, 2024
PUBLISHED
Description
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
| Vendor | Product | Versions |
|---|---|---|
Apache Software Foundation | Apache HTTP Server | affected 2.4.0 to 2.4.23 |
References
https://support.apple.com/HT208221
x_refsource_CONFIRM
DSA-3796
vendor-advisory
x_refsource_DEBIAN
40961
exploit
x_refsource_EXPLOIT-DB
1037508
vdb-entry
x_refsource_SECTRACK
RHSA-2017:1413
vendor-advisory
x_refsource_REDHAT
RHSA-2017:1161
vendor-advisory
x_refsource_REDHAT
https://www.tenable.com/security/tns-2017-04
x_refsource_CONFIRM
RHSA-2017:1414
vendor-advisory
x_refsource_REDHAT
95078
vdb-entry
x_refsource_BID
RHSA-2017:1415
vendor-advisory
x_refsource_REDHAT
RHSA-2017:0906
vendor-advisory
x_refsource_REDHAT
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-0736
x_refsource_CONFIRM
GLSA-201701-36
vendor-advisory
x_refsource_GENTOO
https://security.netapp.com/advisory/ntap-20180423-0001/
x_refsource_CONFIRM
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
mailing-list
x_refsource_MLIST
[httpd-cvs] 20210330 svn commit: r1888194 [10/13] - /httpd/site/trunk/content/security/json/
mailing-list
x_refsource_MLIST
[httpd-cvs] 20210330 svn commit: r1073139 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now