CVE-2016-8212

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
n/a	RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2	RSA BSAFE Crypto-J RSA BSAFE Crypto-J versions prior to 6.2.2

References

http://www.securityfocus.com/archive/1/540066/30/0/threadedMailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95831Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037732Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/540066/30/0/threadedMailing List, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95831Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037732Third Party Advisory, VDB Entry

Timeline

Published: Feb 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-82136.1EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; CVE-2016-82146.7EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3.0 and 7.3.1 contain a vulnerability that may allow malicious admin CVE-2016-82156.1EMC RSA Security Analytics 10.5.3 and 10.6.2 contains fixes for a Reflected Cross-Site Scripting vulnerability that could potentially be exp CVE-2016-82166.7EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS)CVE-2016-82173.7EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by m CVE-2016-82189.8An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete CVE-2016-82196.5An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with CVE-2016-82207.5Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The ap CVE-2016-82217.0Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded i CVE-2016-82224.4A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows CVE-2016-82237.8During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation softw CVE-2016-82244.4A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a sy