Vulnerability
CVE-2016-2178
CVE-2016-2178 is a medium-severity vulnerability (CVSS v3.1 5.5). As of 2026-10-29, 5 721 hosts in our data show software it affects on an open service in at least 15 countries.
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
- Published
- 2016-06-20
- Last modified
- 2026-06-17
- CVSS score
- 5.5 CVSS v3.1
- CVSS vector (v3.1)
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Exploit likelihood (EPSS)
- 1.2% in the next 30 days (top 31% of CVEs)
Exposure in our data
5 721 hosts
Hosts whose banner shows an affected software version on a service open at their latest check.
Not counted: 89 hosts with this CVE only from an older observation.
Not counted: 2 714 more on distribution builds that may be patched (the distribution may have backported the fix without changing the version).
60 more hosts had it earlier (the software version has since changed or the service is gone).
Counted 2026-10-29 04:21 UTC
By country
| Japan JP | 927 |
| Czechia CZ | 879 |
| United States US | 575 |
| China CN | 511 |
| Germany DE | 278 |
| South Korea KR | 229 |
| France FR | 205 |
| Italy IT | 186 |
| Indonesia ID | 139 |
| Romania RO | 139 |
| Netherlands NL | 112 |
| United Kingdom GB | 92 |
| Sweden SE | 85 |
| Spain ES | 81 |
| Russia RU | 81 |
Affected software seen
| openssl 1.0.1e | 1 802 |
| openssl 1.0.1k | 1 059 |
| openssl 1.0.1t | 436 |
| openssl 1.0.2h | 405 |
| openssl 1.0.2d | 340 |
| openssl 1.0.1i | 246 |
| openssl 1.0.1m | 237 |
| openssl 1.0.1g | 185 |
| openssl 1.0.1p | 157 |
| openssl 1.0.1c | 152 |
| openssl 1.0.1j | 120 |
| openssl 1.0.2g | 114 |