Description
A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The OpenSSL Project | openssl | openssl 1.0.1u | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.2a-1 | — |
| Debian 13 | openssl | 1.0.2a-1 | — |
| Debian 12 | openssl | 1.0.2a-1 | — |
| Debian 8 | openssl | 1.0.1t-1+deb8u6 | DSA-3773-1 |
| Debian 7 | openssl | 1.0.1t-1+deb7u2 | DLA-814-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | openssl | 1.0.2g-1ubuntu4.6 | USN-3181-1 |
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.22 | USN-3181-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssl +4 | 1:1.0.2k-8.el7 | RHBA-2017:1929 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-10.redhat_10.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-22.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-24.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +7 | 2.4.23-120.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.1-19.GA.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.23-120.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.0.2h-13.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2017:0605-1 |
| SLES 12 SP1 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2017:0605-1 |
| SLES 12 SP1 | openssl | 1.0.1i-54.5.1 | SUSE-SU-2017:0461-1 |
| SLES 12 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2017:0605-1 |
| SLES 12 | openssl | 1.0.1i-27.28.1 | SUSE-SU-2018:0112-1 |
| SLES 11 SP4 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SLES 11 SP3 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 | openssl1 | 1.0.1g-0.57.1 | SUSE-SU-2017:0495-1 |
| SUSE Studio Onsite 1.3 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SLES for SAP 12 SP2 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2017:0605-1 |
| SLES for SAP 12 SP1 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2017:0605-1 |
| SLES for SAP 12 SP1 | openssl | 1.0.1i-54.5.1 | SUSE-SU-2017:0461-1 |
| SLES for SAP 11 SP4 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SUSE OpenStack Cloud 5 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SUSE Manager Proxy 2.1 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SUSE Manager 2.1 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_0_0 | 1.0.2u-6.2 | openSUSE-SU-2024:11126-1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 15
- RHSA-2017:1801 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:1414 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6 Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:1413 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7 Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHBA-2017:1929 Red Hat Bug Fix Advisory: openssl bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- USN-3181-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-814-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3773-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:0112-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0461-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0495-1 Security update for openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0585-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0605-1 Security update for compat-openssl098 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11126-1 libopenssl-1_0_0-devel-1.0.2u-6.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://eprint.iacr.org/2016/1195
- RHSA-2017:1801 vendor-advisory
- https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008
- RHSA-2017:1413 vendor-advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig
- 1037575 vdb-entry
- RHSA-2017:1414 vendor-advisory
- [oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL) mailing-list
- DSA-3773 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056
- https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html
- 95375 vdb-entry
- RHSA-2017:1415 vendor-advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig
- https://security-tracker.debian.org/tracker/CVE-2016-7056
- RHSA-2017:1802 vendor-advisory