CVE-2016-8217

CVE-2016-8217 describes a timing attack vulnerability in EMC RSA BSAFE Crypto-J versions prior to 6.2.2, specifically impacting the handling of PKCS#12 files. An attacker could exploit this by modifying a PKCS#12 file with an unknown password and then iteratively guessing the integrity MAC one byte at a time due to the toolkit's non-constant-time MAC comparison. The vulnerability has a CVSSv3.1 score of 3.7 (LOW), indicating a network-based attack with high attack complexity, but only a potential for low confidentiality impact and no integrity or availability impact. Its EPSS score is very low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and no community discussion or media coverage, indicating a low-profile vulnerability with little current threat.