CVE-2016-8212

{"id": "CVE-2016-8212", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-02-03T07:59:00.357", "references": [{"url": "http://www.securityfocus.com/archive/1/540066/30/0/threaded", "tags": ["Mailing List", "Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "http://www.securityfocus.com/bid/95831", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "http://www.securitytracker.com/id/1037732", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en las versiones de EMC RSA BSAFE Crypto-J anteriores a 6.2.2. Hay una Vulnerabilidad de validaci\u00f3n OCSP incorrecta. Las respuestas OCSP tienen dos valores de tiempo: thisUpdate y nextUpdate. \u00c9stos especifican un per\u00edodo de validez; Sin embargo, ambos valores son opcionales. Crypto-J trata la falta de un nextUpdate como indicando que la respuesta OCSP es v\u00e1lida indefinidamente en lugar de restringir su validez durante un breve per\u00edodo que rodea el tiempo thisUpdate. Esta vulnerabilidad es similar al problema descrito en CVE-2015-4748."}], "lastModified": "2021-12-15T15:31:07.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:bsafe_crypto-j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851A69E5-4591-4C1E-8824-1A30F1B885C3", "versionEndExcluding": "6.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}