CVE-2016-2183

Priority
Low
Description
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec
protocols and other protocols and products, have a birthday bound of
approximately four billion blocks, which makes it easier for remote
attackers to obtain cleartext data via a birthday attack against a
long-duration encrypted session, as demonstrated by an HTTPS session using
Triple DES in CBC mode, aka a "Sweet32" attack.
References
Bugs
Notes
 mdeslaur> DES ciphers aren't typically selected as there are other
 mdeslaur> stronger ciphers placed earlier in default cipher lists
 mdeslaur> gnutls puts AES before 3DES in the cipher list
Package
Upstream:needs-triage
Ubuntu 17.10 (Artful Aardvark):DNE
Ubuntu 12.04 ESM (Precise Pangolin):DNE (precise was released [7u121-2.6.8-1ubuntu0.12.04.3])
Ubuntu 14.04 LTS (Trusty Tahr):released (7u121-2.6.8-1ubuntu0.14.04.3)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Upstream:needs-triage
Ubuntu 17.10 (Artful Aardvark):DNE
Ubuntu 12.04 ESM (Precise Pangolin):DNE (precise was released [6b41-1.13.13-0ubuntu0.12.04.1])
Ubuntu 14.04 LTS (Trusty Tahr):released (6b41-1.13.13-0ubuntu0.14.04.1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Upstream:needs-triage
Ubuntu 17.10 (Artful Aardvark):DNE
Ubuntu 12.04 ESM (Precise Pangolin):DNE (precise was needs-triage)
Ubuntu 14.04 LTS (Trusty Tahr):needs-triage
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Upstream:needs-triage
Ubuntu 17.10 (Artful Aardvark):released (1.0.2g-1ubuntu9)
Ubuntu 12.04 ESM (Precise Pangolin):released (1.0.1-4ubuntu5.37)
Ubuntu 14.04 LTS (Trusty Tahr):released (1.0.1f-1ubuntu2.20)
Ubuntu 16.04 LTS (Xenial Xerus):released (1.0.2g-1ubuntu4.4)
Ubuntu 17.04 (Zesty Zapus):released (1.0.2g-1ubuntu9)
Patches:
Upstream:https://git.openssl.org/?p=openssl.git;a=commit;h=0fff5065884d5ac61123a604bbcee30a53c808ff (1.0.2)
Upstream:https://git.openssl.org/?p=openssl.git;a=commit;h=e95f5e03f6f1f8d3f6cbe4b7fa48e57b4cf8fd60 (1.0.1)
Package
Upstream:needs-triage
Ubuntu 17.10 (Artful Aardvark):not-affected (8u121-b13-3)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 LTS (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (8u121-b13-0ubuntu1.16.04.2)
Ubuntu 17.04 (Zesty Zapus):not-affected (8u121-b13-3)
Package
Upstream:not-affected
Ubuntu 17.10 (Artful Aardvark):DNE
Ubuntu 12.04 ESM (Precise Pangolin):not-affected
Ubuntu 14.04 LTS (Trusty Tahr):not-affected
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 17.04 (Zesty Zapus):DNE
Package
Source: nss (LP Ubuntu Debian)
Upstream:released (3.27)
Ubuntu 17.10 (Artful Aardvark):released (2:3.28.4-0ubuntu1)
Ubuntu 12.04 ESM (Precise Pangolin):released (2:3.28.4-0ubuntu0.12.04.1)
Ubuntu 14.04 LTS (Trusty Tahr):released (2:3.28.4-0ubuntu0.14.04.1)
Ubuntu 16.04 LTS (Xenial Xerus):released (2:3.28.4-0ubuntu0.16.04.1)
Ubuntu 17.04 (Zesty Zapus):released (2:3.28.4-0ubuntu0.17.04.1)
Patches:
Upstream:https://hg.mozilla.org/projects/nss/rev/a1b0b7023e19
Upstream:https://hg.mozilla.org/projects/nss/rev/71da21e9d6e9
Package
Upstream:not-affected
Ubuntu 17.10 (Artful Aardvark):not-affected
Ubuntu 12.04 ESM (Precise Pangolin):DNE (precise was not-affected)
Ubuntu 14.04 LTS (Trusty Tahr):not-affected
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
Ubuntu 17.04 (Zesty Zapus):not-affected
More Information

Updated: 2017-10-23 12:23:35 UTC (commit 13562)