Apache HTTP Server Cryptographic Issues Vulnerability - CVE-2016-0736 - Vulnerability Database

Apache HTTP Server Cryptographic Issues Vulnerability - CVE-2016-0736

High

Reference: CVE-2016-0736

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-0736

Title: Apache HTTP Server Cryptographic Issues Vulnerability

Overview:

In Apache HTTP Server versions 2.4.0 to 2.4.23 mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default) hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks particularly with CBC.