CVE-2016-2183

Priority
Low
Description
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec
protocols and other protocols and products, have a birthday bound of
approximately four billion blocks, which makes it easier for remote
attackers to obtain cleartext data via a birthday attack against a
long-duration encrypted session, as demonstrated by an HTTPS session using
Triple DES in CBC mode, aka a "Sweet32" attack.
References
Bugs
Notes
 mdeslaur> DES ciphers aren't typically selected as there are other
 mdeslaur> stronger ciphers placed earlier in default cipher lists
 mdeslaur> gnutls puts AES before 3DES in the cipher list
Package
Upstream:needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):released (7u121-2.6.8-1ubuntu0.12.04.3)
Ubuntu 14.04 LTS (Trusty Tahr):released (7u121-2.6.8-1ubuntu0.14.04.3)
Ubuntu Touch 15.04:DNE
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 16.10 (Yakkety Yak):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Upstream:needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):released (6b41-1.13.13-0ubuntu0.12.04.1)
Ubuntu 14.04 LTS (Trusty Tahr):released (6b41-1.13.13-0ubuntu0.14.04.1)
Ubuntu Touch 15.04:DNE
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 16.10 (Yakkety Yak):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Upstream:needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):needs-triage
Ubuntu 14.04 LTS (Trusty Tahr):needs-triage
Ubuntu Touch 15.04:DNE
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 16.10 (Yakkety Yak):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Upstream:needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):released (1.0.1-4ubuntu5.37)
Ubuntu 14.04 LTS (Trusty Tahr):released (1.0.1f-1ubuntu2.20)
Ubuntu Touch 15.04:pending (1.0.1f-1ubuntu11.7)
Ubuntu Core 15.04:pending (1.0.1f-1ubuntu11.7)
Ubuntu 16.04 LTS (Xenial Xerus):released (1.0.2g-1ubuntu4.4)
Ubuntu 16.10 (Yakkety Yak):released (1.0.2g-1ubuntu9)
Ubuntu 17.04 (Zesty Zapus):released (1.0.2g-1ubuntu9)
Patches:
Upstream:https://git.openssl.org/?p=openssl.git;a=commit;h=0fff5065884d5ac61123a604bbcee30a53c808ff (1.0.2)
Upstream:https://git.openssl.org/?p=openssl.git;a=commit;h=e95f5e03f6f1f8d3f6cbe4b7fa48e57b4cf8fd60 (1.0.1)
Package
Upstream:needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 14.04 LTS (Trusty Tahr):DNE
Ubuntu Touch 15.04:DNE
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (8u121-b13-0ubuntu1.16.04.2)
Ubuntu 16.10 (Yakkety Yak):released (8u121-b13-0ubuntu1.16.10.2)
Ubuntu 17.04 (Zesty Zapus):not-affected (8u121-b13-3)
Package
Upstream:not-affected
Ubuntu 12.04 LTS (Precise Pangolin):not-affected
Ubuntu 14.04 LTS (Trusty Tahr):not-affected
Ubuntu Touch 15.04:DNE
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 16.10 (Yakkety Yak):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Source: nss (LP Ubuntu Debian)
Upstream:released (3.27)
Ubuntu 12.04 LTS (Precise Pangolin):needed
Ubuntu 14.04 LTS (Trusty Tahr):needed
Ubuntu Touch 15.04:needed
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 16.10 (Yakkety Yak):needed
Ubuntu 17.04 (Zesty Zapus):needed
Patches:
Upstream:https://hg.mozilla.org/projects/nss/rev/a1b0b7023e19
Upstream:https://hg.mozilla.org/projects/nss/rev/71da21e9d6e9
Package
Upstream:not-affected
Ubuntu 12.04 LTS (Precise Pangolin):not-affected
Ubuntu 14.04 LTS (Trusty Tahr):not-affected
Ubuntu Touch 15.04:not-affected
Ubuntu Core 15.04:not-affected
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
Ubuntu 16.10 (Yakkety Yak):not-affected
Ubuntu 17.04 (Zesty Zapus):not-affected
More Information

Updated: 2017-02-27 21:14:14 UTC (commit 12157)