CVE-2016-2107
Node.js 4: The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation…
CVE-2016-2107 is fixed in Node.js 4 on 1 platform by Node.js 4 4.4.4 (version 4.4.4), released May 5, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.9
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.8906
99th percentile
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.4.4 | Node.js 4 4.4.4 | May 5, 2016 |