CVE-2016-3995: Infoleak
Published Feb 13, 2017
·Updated
The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks.
Affected Software
1 affected component
Cryptopp Crypto\+\+<=5.6.3
Remediation
Patch Available
Patch Available
Event History
Feb 13, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-3995?
CVE-2016-3995 is considered a high-severity vulnerability due to its potential to allow timing attacks.
2
How do I fix CVE-2016-3995?
To fix CVE-2016-3995, upgrade Crypto++ to version 5.6.4 or later.
3
What does CVE-2016-3995 affect?
CVE-2016-3995 affects Crypto++ versions up to and including 5.6.3.
4
What type of attack is enabled by CVE-2016-3995?
CVE-2016-3995 allows attackers to conduct timing attacks due to optimized-out timing protection.
5
Who is vulnerable to CVE-2016-3995?
Developers and users of affected versions of Crypto++ are vulnerable to CVE-2016-3995.