CVE-2016-0702, known as "CacheBleed," is a side-channel vulnerability in OpenSSL versions 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g, affecting products like Canonical, Debian, and Node.js. It allows a local attacker to potentially discover RSA private keys by exploiting cache-bank access times during modular exponentiation on Intel Sandy Bridge CPUs. With a CVSS score of 5.1 (Medium), this attack requires high attack complexity and local access, but could lead to a complete compromise of confidentiality. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or Nuclei, though it has received some media coverage and community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.1CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:* | ||
1.0.1CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:* | ||
1.0.1CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:* | ||
1.0.1CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:* | ||
1.0.1aCPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.