AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2016-0703

MEDIUM · CVSS 5.9 EPSS 5.40%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2016-03-02 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE
CVE-2016-0703
Severity
MEDIUM
CVSS
5.9
EPSS
5.40%
Oracle OpenSSL

Original Filing — NVD Description

The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.