CVE-2016-0736

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-0736
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-0736.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-0736
Downstream
Related
Published
2017-07-27T21:29:00.177Z
Modified
2026-04-16T01:38:34.223597406Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

In Apache HTTP Server versions 2.4.0 to 2.4.23, modsessioncrypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
da5873e80d6eee7a0838793bf68f1d0254745fbb
Last affected
60fa04727910859b5512f7bbb36c53c4652cff2c
Last affected
67578c0315accbca1bba22d695c59d51197c99cc
Last affected
14434f9be6e1624a4b3070b0df00901fb62e9ca4
Last affected
7650f0ca88028593a7c5fbba2e20bca4a65b031d
Last affected
f2b561181dbd0c689fd583c60878ce05854ec5f9
Last affected
01062a2c2e772b8799ed6499b684756d4dc8cf0c
Last affected
7ea253ccfeaec99b5684c909dce6d9a6d7ee6486
Last affected
015ab81d44c1f6def12fdbb7dc8d8241bf8e3ef5
Last affected
1287b680fbde78d9289029b6a6b63a3f9e58d704
Last affected
82a14461846706f52f0bb7950f41d2878bc2aa1d
Last affected
2d1deb10cfafe25ade7f30307e13b6d0c21a5473
Last affected
fd7b5c2c8b7549905ada63869757eac5c74d1c73
Last affected
6e65a7f3dadcade4274ae53f734d4c35188e3786
Last affected
a20d31be7d66d2f9bfeadfc23e54763b36abba08
Last affected
eabf29a378c3252811e0e88a77717e67b63c1c8b
Last affected
ef07cb031c6f8f7ac483c26fc858aad68c365fd9
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.14:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.19:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.21:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.22:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*"
    ],
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.0"
        },
        {
            "last_affected": "2.4.1"
        },
        {
            "last_affected": "2.4.2"
        },
        {
            "last_affected": "2.4.3"
        },
        {
            "last_affected": "2.4.6"
        },
        {
            "last_affected": "2.4.7"
        },
        {
            "last_affected": "2.4.8"
        },
        {
            "last_affected": "2.4.9"
        },
        {
            "last_affected": "2.4.10"
        },
        {
            "last_affected": "2.4.12"
        },
        {
            "last_affected": "2.4.14"
        },
        {
            "last_affected": "2.4.16"
        },
        {
            "last_affected": "2.4.19"
        },
        {
            "last_affected": "2.4.20"
        },
        {
            "last_affected": "2.4.21"
        },
        {
            "last_affected": "2.4.22"
        },
        {
            "last_affected": "2.4.23"
        }
    ]
}

Affected versions

2.*
2.4.0
2.4.1
2.4.10
2.4.12
2.4.14
2.4.16
2.4.19
2.4.2
2.4.20
2.4.21
2.4.22
2.4.23
2.4.3
2.4.6
2.4.7
2.4.8
2.4.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-0736.json"