{"id":"CVE-2016-3452","details":"Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption.","modified":"2026-02-24T01:15:56.494941Z","published":"2016-07-21T10:12:16.240Z","references":[{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0705.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1480.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1481.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1602.html"},{"type":"ADVISORY","url":"http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/91787"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/91999"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1036362"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1132"},{"type":"ADVISORY","url":"https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/"},{"type":"ADVISORY","url":"https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/"},{"type":"ADVISORY","url":"https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/"},{"type":"FIX","url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mariadb/server","events":[{"introduced":"5a6300dcc45da2d6c2b046560da0580548354b93"},{"fixed":"e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69"},{"introduced":"776555af021e917ce0d6235386b43ae59fdd5161"},{"fixed":"c0238be6cfaaf17c7c3a6f3fc59937cc13cc00be"},{"introduced":"b11c4651917bd4472ea8837c64e6d1072a2a19e9"},{"fixed":"ee0695b8072783d04b27328f974d94273b3fa248"}]}],"database_specific":{"vanir_signatures":[{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/taocrypt/include/asn.hpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["328989789902264073105121061630412099552","113226449832742612457907525761418099578","3574268165857188010827246450020936726","256024421303372279615573161997334143955","24381003380136022118873075175408425078","169637781681132709185321462432072643703","157075832564591690505815115672437338718","79738385756851413932132919073172844243"]},"id":"CVE-2016-3452-2682245b"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertDecoder::CertDecoder","file":"extra/yassl/taocrypt/src/asn.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":310,"function_hash":"84275643727078484617033832623427531850"},"id":"CVE-2016-3452-62a4fb8d"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertManager::Validate","file":"extra/yassl/src/cert_wrapper.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":1712,"function_hash":"167463775338451700908322937717006190459"},"id":"CVE-2016-3452-728de7ee"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509_NAME::X509_NAME","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":198,"function_hash":"271021307451713760989459661087859249867"},"id":"CVE-2016-3452-86543b13"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"SSL_SESSION::CopyX509","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":446,"function_hash":"328709498410265840796879386376762744585"},"id":"CVE-2016-3452-90892928"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/testsuite/test.hpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["38888561071553782601497217870487296406","84630106213376539451783977885300350","126873917473392384404025904920480303267","289469507619928486694709845281643330112","161888496435859381343451923301229701268","193907191833464268618595565791894261019","301154113693461807935536702603114992455"]},"id":"CVE-2016-3452-9ba31f1c"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/include/yassl_int.hpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["197676009365587550327544010096750809384","314940809980753828848783963225307749027","302734122978458677552155764040696891768","267110121444471672465268460044649953833","245102166208011813528119248589723473864","299053424134247118890077777126455034544","8171099089091038527887401362974341294","96688523906906507151564659160083122450","196941056280297493524084236661494948405","96437588204849755191236371882039889927","40793978437740086607064551101259185780","298338702324467118272975565189642623433","134442357808225387562236697971928957334","137151124011183786622956729798563364320","235970099255474533973573550653151028787"]},"id":"CVE-2016-3452-9fe8170c"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/src/cert_wrapper.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["115937134762707342620900220190617838770","191777410853952707717371150265731110878","230559820896096789113093095887683112355","340132970365716037207863197366747015004","192203953599706866930858264990409834751","335084834680075071463060046330911643124","248989000053315722845574704130845032843","224427207711222579328297629895090376047"]},"id":"CVE-2016-3452-aaac2f9e"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertManager::setPeerX509","file":"extra/yassl/src/cert_wrapper.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":449,"function_hash":"258499531445180797406889695706151720762"},"id":"CVE-2016-3452-ab04c6ed"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/src/ssl.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["89880174685555393287789502483324256712","115805482583513444906159117756029482431","8380791449735680843426398503455966188","332040867410817621730468160608364043163","323135279895813047828312530166225685818","274158098018355611255930835363257318785","203456512712712940938422729603369118857","288275627649541686001805175881881304170","293718237998797735582895887301126882496","337073332161807197369532953483253679675","55723517845916282074728728958983286004"]},"id":"CVE-2016-3452-ac437cb2"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509_NAME_get_index_by_NID","file":"extra/yassl/src/ssl.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":309,"function_hash":"31745880026361593054873911460947510829"},"id":"CVE-2016-3452-acc69a69"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"showPeer","file":"extra/yassl/testsuite/test.hpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":358,"function_hash":"23188152673892202387393630634900983674"},"id":"CVE-2016-3452-ad5bd6fb"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509_NAME::GetEntry","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":464,"function_hash":"336412826170946265438186393621591155399"},"id":"CVE-2016-3452-b07f25a1"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509::X509","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":282,"function_hash":"262389965711401415449304632826999710791"},"id":"CVE-2016-3452-ca8c0ce8"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/taocrypt/src/asn.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["45725143492301185293449315779667149850","310052851053072881712361048698141642299","296436757348388768923463758269842448031","173611470122246371348441785265481646045","40516398055507048464363498871023472627","192467063586620192734617425788441006471","161668190576412136651550215827899966397","332028413135809880679059706752852236996","340013176742164718874769220079050629323"]},"id":"CVE-2016-3452-e9795d06"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["192203953599706866930858264990409834751","335084834680075071463060046330911643124","180711112930894200225363551220949114109","314161287644899398066458886519357039581","139777218675763736943322847753660642224","324465363473437865236249591444351188374","257726177045510299031194402727514190155","257110211407308225341523704485011355471","143002162565023789210044919980376504313","239900352708880861797375541566892395744","152509694225800512776662310570109639942","119626593393767768515842304318340383778","30631714303512873200844902916725540027","330744342064730336789161753695318488254","292703688519468536111275548166335914813","297312509248695775690590540102266626807","183883886712552607375104059636567150310","122514278822269368105509471297572449237","148439279788413922044362573854029843627","112772780973672365382117392311885332453","27826086941401304568981431107298627473","184282094108583728476861885967205427738","48421224335455267776238078862594502500","99251990077953032241631696841085244854","218342949418937748904740895263837262534","321856142199616446243721837550871281435","135461715089527967111512171410150117650"]},"id":"CVE-2016-3452-e97dd1e4"},{"source":"https://github.com/mariadb/server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertDecoder::GetName","file":"extra/yassl/taocrypt/src/asn.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":2378,"function_hash":"189313815349090713973326517028888258298"},"id":"CVE-2016-3452-f758bb4c"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-3452.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/mysql/mysql-server","events":[{"introduced":"863a73b80b83801a14b416006e64cf892837a657"},{"fixed":"e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69"}]}],"versions":["mysql-5.0.96","mysql-5.1.61","mysql-5.1.62","mysql-5.1.63","mysql-5.1.65","mysql-5.1.66","mysql-5.1.67","mysql-5.1.68","mysql-5.1.69","mysql-5.1.69-retag","mysql-5.1.70","mysql-5.1.71","mysql-5.1.72","mysql-5.1.73","mysql-5.1.74","mysql-5.1.75","mysql-5.1.76","mysql-5.1.77","mysql-5.5.20","mysql-5.5.21","mysql-5.5.22","mysql-5.5.23","mysql-5.5.24","mysql-5.5.25","mysql-5.5.25a","mysql-5.5.27","mysql-5.5.28","mysql-5.5.29","mysql-5.5.30","mysql-5.5.31","mysql-5.5.32","mysql-5.5.33","mysql-5.5.34","mysql-5.5.35","mysql-5.5.36","mysql-5.5.37","mysql-5.5.38","mysql-5.5.39","mysql-5.5.40","mysql-5.5.41","mysql-5.5.42","mysql-5.5.43","mysql-5.5.44","mysql-5.5.45","mysql-5.5.46","mysql-5.5.47","mysql-5.5.48"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/testsuite/test.hpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["38888561071553782601497217870487296406","84630106213376539451783977885300350","126873917473392384404025904920480303267","289469507619928486694709845281643330112","161888496435859381343451923301229701268","193907191833464268618595565791894261019","301154113693461807935536702603114992455"]},"id":"CVE-2016-3452-055246d0"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertManager::setPeerX509","file":"extra/yassl/src/cert_wrapper.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":449,"function_hash":"258499531445180797406889695706151720762"},"id":"CVE-2016-3452-11933659"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/src/cert_wrapper.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["115937134762707342620900220190617838770","191777410853952707717371150265731110878","230559820896096789113093095887683112355","340132970365716037207863197366747015004","192203953599706866930858264990409834751","335084834680075071463060046330911643124","248989000053315722845574704130845032843","224427207711222579328297629895090376047"]},"id":"CVE-2016-3452-1d831222"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509_NAME::GetEntry","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":464,"function_hash":"336412826170946265438186393621591155399"},"id":"CVE-2016-3452-2b6bb91c"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509_NAME_get_index_by_NID","file":"extra/yassl/src/ssl.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":309,"function_hash":"31745880026361593054873911460947510829"},"id":"CVE-2016-3452-4608b808"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/src/ssl.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["89880174685555393287789502483324256712","115805482583513444906159117756029482431","8380791449735680843426398503455966188","332040867410817621730468160608364043163","323135279895813047828312530166225685818","274158098018355611255930835363257318785","203456512712712940938422729603369118857","288275627649541686001805175881881304170","293718237998797735582895887301126882496","337073332161807197369532953483253679675","55723517845916282074728728958983286004"]},"id":"CVE-2016-3452-56ddaaab"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/include/yassl_int.hpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["197676009365587550327544010096750809384","314940809980753828848783963225307749027","302734122978458677552155764040696891768","267110121444471672465268460044649953833","245102166208011813528119248589723473864","299053424134247118890077777126455034544","8171099089091038527887401362974341294","96688523906906507151564659160083122450","196941056280297493524084236661494948405","96437588204849755191236371882039889927","40793978437740086607064551101259185780","298338702324467118272975565189642623433","134442357808225387562236697971928957334","137151124011183786622956729798563364320","235970099255474533973573550653151028787"]},"id":"CVE-2016-3452-7337cf1d"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["192203953599706866930858264990409834751","335084834680075071463060046330911643124","180711112930894200225363551220949114109","314161287644899398066458886519357039581","139777218675763736943322847753660642224","324465363473437865236249591444351188374","257726177045510299031194402727514190155","257110211407308225341523704485011355471","143002162565023789210044919980376504313","239900352708880861797375541566892395744","152509694225800512776662310570109639942","119626593393767768515842304318340383778","30631714303512873200844902916725540027","330744342064730336789161753695318488254","292703688519468536111275548166335914813","297312509248695775690590540102266626807","183883886712552607375104059636567150310","122514278822269368105509471297572449237","148439279788413922044362573854029843627","112772780973672365382117392311885332453","27826086941401304568981431107298627473","184282094108583728476861885967205427738","48421224335455267776238078862594502500","99251990077953032241631696841085244854","218342949418937748904740895263837262534","321856142199616446243721837550871281435","135461715089527967111512171410150117650"]},"id":"CVE-2016-3452-86ae4031"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509_NAME::X509_NAME","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":198,"function_hash":"271021307451713760989459661087859249867"},"id":"CVE-2016-3452-90a6aecc"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"X509::X509","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":282,"function_hash":"262389965711401415449304632826999710791"},"id":"CVE-2016-3452-9c387409"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertManager::Validate","file":"extra/yassl/src/cert_wrapper.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":1712,"function_hash":"167463775338451700908322937717006190459"},"id":"CVE-2016-3452-a1d47c94"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"SSL_SESSION::CopyX509","file":"extra/yassl/src/yassl_int.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":446,"function_hash":"328709498410265840796879386376762744585"},"id":"CVE-2016-3452-b78e96b9"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/taocrypt/include/asn.hpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["328989789902264073105121061630412099552","113226449832742612457907525761418099578","3574268165857188010827246450020936726","256024421303372279615573161997334143955","24381003380136022118873075175408425078","169637781681132709185321462432072643703","157075832564591690505815115672437338718","79738385756851413932132919073172844243"]},"id":"CVE-2016-3452-c75899bd"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"showPeer","file":"extra/yassl/testsuite/test.hpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":358,"function_hash":"23188152673892202387393630634900983674"},"id":"CVE-2016-3452-da6bae69"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"file":"extra/yassl/taocrypt/src/asn.cpp"},"signature_type":"Line","signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["45725143492301185293449315779667149850","310052851053072881712361048698141642299","296436757348388768923463758269842448031","173611470122246371348441785265481646045","40516398055507048464363498871023472627","192467063586620192734617425788441006471","161668190576412136651550215827899966397","332028413135809880679059706752852236996","340013176742164718874769220079050629323"]},"id":"CVE-2016-3452-de3d0f42"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertDecoder::GetName","file":"extra/yassl/taocrypt/src/asn.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":2378,"function_hash":"189313815349090713973326517028888258298"},"id":"CVE-2016-3452-eac03a29"},{"source":"https://github.com/mysql/mysql-server/commit/e7061f7e5a96c66cb2e0bf46bec7f6ff35801a69","deprecated":false,"target":{"function":"CertDecoder::CertDecoder","file":"extra/yassl/taocrypt/src/asn.cpp"},"signature_type":"Function","signature_version":"v1","digest":{"length":310,"function_hash":"84275643727078484617033832623427531850"},"id":"CVE-2016-3452-eec1c060"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-3452.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}