CVE-2016-3099

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183102.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183129.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184345.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2602.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1319052Issue Tracking, Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183102.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183129.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184345.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2602.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1319052Issue Tracking, Vendor Advisory

Timeline

Published: Jun 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-31008.4kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of o CVE-2016-31015.4Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web CVE-2016-31027.3The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugi CVE-2016-31047.5mongod in MongoDB 2.6, when using 2.4-style users, and 2.4 allow remote attackers to cause a denial of service (memory consumption and proce CVE-2016-31058.8The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository CVE-2016-31065.3Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.CVE-2016-31075.5The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/pki/pulp/nodes/" dir CVE-2016-31087.1The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary files via a symlink att CVE-2016-31099.8The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.CVE-2016-31107.5mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an CVE-2016-31115.5pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the pulp server and pulp CVE-2016-31127.5client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which