CVE-2016-2427 describes a potential cryptographic vulnerability in the AES-GCM specification, specifically regarding the recommended 12-octet aes-ICVlen parameter field, which could theoretically allow attackers to discover an authentication key. This issue primarily affected Android 5.x and 6.x, as well as Bouncy Castle libraries. With a CVSS v3 score of 5.5 (Medium), the vulnerability requires local access and user interaction (UI:R) to potentially achieve high confidentiality impact (C:H). However, the vendor disputes the existence of this vulnerability in Android, stating the default value was only for encoding and not used insecurely. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.54CPE matchmatch criteria | cpe:2.3:a:bouncycastle:bc-java:1.54:*:*:*:*:*:*:* | ||
5.0CPE matchmatch criteria | cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:* | ||
5.0.1CPE matchmatch criteria | cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:* | ||
5.1CPE matchmatch criteria | cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:* | ||
5.1.0CPE matchmatch criteria | cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.