Loading vulnerability…
Out-of-bounds write in OpenSSL BN_bn2dec()
CVE-2016-2182 is an out-of-bounds write vulnerability in OpenSSL's BN_bn2dec() function, which converts a BIGNUM to decimal text. The function fails to check the return value of BN_div_word(). When processing an overly large BIGNUM, a division failure can leave an internal value unreduced, leading to writes beyond an allocated buffer and an eventual application crash. Applications that print oversized certificates or certificate revocation lists (CRLs) from untrusted sources may expose this flaw. Affected branches include OpenSSL 1.0.1 before 1.0.1u and 1.0.2 before 1.0.2i. TLS is not affected because record-size limits reject oversized certificates before parsing.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt application memory and cause a crash, resulting in denial of service. Arbitrary code execution is a possible additional consequence, but is not established as a demonstrated outcome. Exposure depends on whether the application passes attacker-controlled, oversized BIGNUM values to BN_bn2dec(); ordinary TLS certificate processing is not an affected attack path.
If you can’t patch tonight, do this now.
Until patched, prevent affected applications from printing or converting oversized BIGNUM values obtained from untrusted sources, including oversized certificates and CRLs. Restrict access to application interfaces that expose those operations. No universal configuration workaround is established; TLS record limits already prevent the described oversized-certificate attack through ordinary TLS processing.
Patch, then assume compromise.
Install a vendor-supported OpenSSL update containing the fix. The historical upstream fixes were released in OpenSSL 1.0.1u and 1.0.2i; vendor backports may retain earlier base version numbers. Red Hat addressed the issue through RHSA-2016:1940 for RHEL 6 and 7, and RHSA-2018:2185, RHSA-2018:2186, and RHSA-2018:2187 for affected JBoss Core Services deployments. Restart applications and services linked against OpenSSL, or reboot, after updating so that the corrected library is loaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.