What’s Vulnerable › Vulnerabilities

CVE-2016-8635

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-08-01 · updated 2026-06-17
• Weakness: CWE-358

Description

It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group.

Affected products

• Mozilla Network Security Services: from 3.21 through 3.21.4
• RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6
• RedHat Enterprise Linux Server Eus: 7.3, 7.4, 7.5, 7.6
• RedHat Enterprise Linux Server Tus: 7.3, 7.6
• RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0

References

• http://rhn.redhat.com/errata/RHSA-2016-2779.html
• http://www.securityfocus.com/bid/94346
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8635
• https://security.gentoo.org/glsa/201701-46
• http://rhn.redhat.com/errata/RHSA-2016-2779.html
• http://www.securityfocus.com/bid/94346
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8635
• https://security.gentoo.org/glsa/201701-46

Get alerted when CVE-2016-8635 or the next vulnerability affects your stack