CVE-2016-7055: nodejs node.js
Vulnerability summary
CVE-2016-7055 is a medium (CVSS 5.9) vulnerability in nodejs node.js. EPSS estimates a 14.22% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 6Timeline
- 04-05-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible erroneous outcome of public-key operations with specially crafted input. Among EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation. Impact was not analyzed in detail, because pre-requisites for attack are considered unlikely. Namely multiple clients have to choose the curve in question and the server has to share the private key among them, neither of which is default behaviour. Even then only clients that chose the curve will be affected.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
14.22%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 14.22% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- openssl≥ 1.0.2, < 1.0.2k-r0
Debian1 product
- openssl< 1.1.0c-1
Nodejs1 product
- node.js≥ 4.0.0, ≤ 4.1.2 | ≥ 4.2.0, < 4.7.3 | ≥ 6.0.0, ≤ 6.8.1 | ≥ 6.9.0, < 6.9.5 | ≥ 7.0.0, < 7.5.0
Openssl1 product
- openssl≥ 1.0.2, < 1.0.2k | ≥ 1.1.0, < 1.1.0c
Ubuntu1 product
- openssl< 1.0.2g-1ubuntu4.6
5 vendors · 5 products
References
21 links- www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlX Refsource CONFIRMPatchThird Party Advisory
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03744en_usX Refsource CONFIRMThird Party AdvisoryVDB Entry
- security.freebsd.org/advisories/FreeBSD-SA-17:02.openssl.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlX Refsource CONFIRMPatchThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlX Refsource CONFIRMPatchThird Party Advisory
Show all 21 references
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03752en_usX Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party Advisory
