CVE-2016-2183

CWE-200 — Information ExposureCWE-327 — Broken Cryptographic AlgorithmCWE-119 — Buffer OverflowCWE-310CWE-63531 documents12 sources
Severity
7.5HIGH
EPSS
41.0%
top 2.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Github.com Kyverno/kyvernoNodejs Node.jsPython Python+7 more
Timeline
PublishedSep 1
Latest updateOct 31

Description

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages14 packages

▶NVDoracle/database11.2.0.4, 12.1.0.2+1
▶NVDpython/python2.7.0 — 2.7.13+2
▶NVDnodejs/node.js0.10.0 — 0.10.47+4
▶Ubuntunss< 2:3.28.4-0ubuntu0.14.04.1+1

Also affects: Enterprise Linux 5.0, 6.0, 7.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

8
OSV
Kyverno vulnerable due to usage of insecure cipher↗2023-05-30
▶
GHSA
Kyverno vulnerable due to usage of insecure cipher↗2023-05-30
▶
GHSA
GHSA-w2rw-pv8p-h9c8: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately↗2022-05-13
▶
OSV
nss vulnerabilities↗2017-04-27
▶
OSV
openjdk-7 vulnerabilities↗2017-02-09
▶

📋Vendor Advisories

10
Red Hat
openshift: etcd grpc-proxy vulnerable to The Birthday attack against 64-bit block cipher↗2023-01-16
▶
Oracle
Oracle Oracle Siebel CRM Risk Matrix: EAI, SWSE (OpenSSL) — CVE-2016-2183↗2021-10-15
▶
Ubuntu
NSS vulnerability↗2017-07-31
▶
Ubuntu
NSS vulnerabilities↗2017-04-27
▶
Ubuntu
OpenJDK 6 vulnerabilities↗2017-02-16
▶

🕵️Threat Intelligence

1
Huntress
CVE-2016-2183 Vulnerability: Analysis, Impact, Mitigation | Huntress↗
▶

💬Community

11
HackerOne
blockstack.org - is vulnerable to (CVE-2016-2183, CVE-2016-6329)↗2025-10-31
▶
Bugzilla
CVE-2016-2183 openshift-enterprise-console-container: SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) [openshift-enterprise-3.11.z]↗2019-08-26
▶
HackerOne
Yelp.com is vulnerable to SWEET32 attack↗2017-11-09
▶
HackerOne
sweet32↗2017-05-04
▶
HackerOne
SWEET32 TLS attack↗2017-02-01
▶
CVE-2016-2183 (HIGH CVSS 7.5) | The DES and Triple DES ciphers | cvebase.io