CVE-2016-6887: Infoleak
Published Jan 13, 2017
·Updated
The pstmexptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via a CRT attack.
Affected Software
1 affected component
MatrixSSL MatrixSSL<=3.8.6
Remediation
Patch Available
Event History
Jan 13, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6887?
CVE-2016-6887 has a high severity rating due to its potential to allow remote attackers to predict secret keys.
2
How do I fix CVE-2016-6887?
To fix CVE-2016-6887, users should upgrade to MatrixSSL versions later than 3.8.6 where the vulnerability is addressed.
3
What impact does CVE-2016-6887 have on systems using MatrixSSL?
CVE-2016-6887 can allow attackers to compromise the confidentiality of encrypted communications by predicting the private key.
4
Who is affected by CVE-2016-6887?
CVE-2016-6887 affects all versions of MatrixSSL up to and including 3.8.6.
5
What is the main issue caused by CVE-2016-6887?
The main issue with CVE-2016-6887 is improper modular exponentiation, which makes it vulnerable to a CRT attack.