Loading vulnerability…
CVE-2016-2183, known as Sweet32, is a cryptographic design weakness in 64-bit-block DES and Triple DES cipher suites, particularly when used in CBC mode for TLS/SSL. Birthday-bound collisions become practical when a large volume of data is encrypted under the same session key, potentially allowing an on-path attacker to derive portions of protected plaintext from captured traffic.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept (POC) demonstration of the Sweet32 attack (CVE-2016-2183), which targets cryptographic protocols using 64-bit block ciphers (notably 3DES) in CBC mode. The attack exploits the birthday paradox to recover secret plaintext (such as session cookies) from encrypted traffic by identifying collisions in ciphertext blocks. The repository contains several Python scripts: - `generate_packets.py`: Generates a large number of encrypted HTTP request/response packets with a user-specified cookie, simulating real-world encrypted traffic. - `generate_rigged_packets.py`: Crafts a special packet with a guaranteed block collision, allowing the attack to be demonstrated quickly and reliably. - `sweet32.py`: Implements the Sweet32 attack logic, scanning the encrypted packet file for block collisions and recovering the secret cookie value using the attack formula. - `lib/packetfile.py` and `lib/tridescbc.py`: Provide utility functions for packet file I/O and 3DES CBC encryption/decryption. The exploit does not target a specific product but rather demonstrates the general vulnerability of 64-bit block ciphers in CBC mode to birthday attacks. The scripts are self-contained and require only Python 3 and the pycryptodome library. The attack vector is network-based, simulating the interception and analysis of encrypted HTTP traffic. The endpoints used are simulated (localhost:5000) and file-based packet dumps for demonstration purposes. No real-world network exploitation is performed; the repository is intended for educational and research use.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Sweet32 is a cryptographic attack against 64-bit block ciphers such as 3DES in long-lived TLS connections carrying high traffic volumes; it is the underlying weakness relevant to the Kyverno issue.
A cryptographic weakness affecting 64-bit block ciphers such as 3DES, enabling limited plaintext recovery under long-lived TLS connections with sufficiently large traffic volumes.
Уязвимость Sweet32, затрагивающая DES/3DES из-за 64-битного размера блока и позволяющая атаки на конфиденциальность длительных зашифрованных сессий.
A cryptographic weakness involving 3DES, referenced here as an example of weak cryptography present in some Android VPN app OpenVPN configurations.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.