CVE-2016-2183: Infoleak
A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite.
Other sources
Ciphers with 64-bit block sizes used in CBC mode were found to be vulnerable to birthday attack when key renegotiation doesn't happen frequently or at all in long running connections. 3DES cipher as used in TLS protocol is vulnerable to this attack, that allows remote attacker to recover partial plaintext information (XOR of two plaintext blocks).
— Red Hat
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec pro ...
— Debian
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-2183?
CVE-2016-2183 is considered a medium severity vulnerability due to its potential impact on encrypted data.
How do I fix CVE-2016-2183?
To fix CVE-2016-2183, upgrade to the recommended versions specified by your affected packages, including jbcs-httpd24-httpd and jbcs-httpd24-openssl.
What systems are affected by CVE-2016-2183?
CVE-2016-2183 affects systems using DES/3DES ciphers as part of the TLS/SSL protocol, particularly those under Red Hat's supported packages.
What are the risks associated with CVE-2016-2183?
The primary risk of CVE-2016-2183 is that an attacker could conduct a man-in-the-middle attack to recover plaintext data from TLS/SSL communications.
Is there a workaround for CVE-2016-2183?
While upgrading is the most effective solution, temporarily disabling DES/3DES cipher suites can serve as a workaround until systems are updated.