CVE-2016-3099
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat...
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
- Record
CVE-2016-3099- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
CVE List No score
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
- Record
CVE-2016-3099- Updated
- 2026-11-02
EUVDEUVD-2016-4154 No score
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
- Record
EUVD-2016-4154- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6rg6-w3xx-cvm5
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat...
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
- Record
GHSA-6rg6-w3xx-cvm5- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-327
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-3099
mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.
- Record
UBUNTU-CVE-2016-3099- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0197 No score
Updated apache-mod_nss packages fix CVE-2016-3099
Updated apache-mod_nss package fixes security vulnerability:
Attempting to exclude ciphers from the list of accepted ciphers to use may not work as expected (CVE-2016-3099).
- Record
MGASA-2016-0197- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10311-1 No score
apache2-mod_nss-1.0.14-4.1 on GA media
These are all security issues fixed in the apache2-mod_nss-1.0.14-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10311-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2285-1 No score
Security update for apache2-mod_nss
This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements:
- Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)
- Created valgrind suppression files to ease debugging.
- Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.
- Improvements to migrate.pl.
- Update default ciphers to something more modern and secure.
- Check for host and netstat commands in gencert before trying to use them.
- Add server support for DHE ciphers.
- Extract SAN from server/client certificates into env
- Fix memory leaks and other coding issues caught by clang analyzer.
- Add support for Server Name Indication (SNI).
- Add support for SNI for reverse proxy connections.
- Add RenegBufferSize? option.
- Add support for TLS Session Tickets (RFC 5077).
- Fix logical AND support in OpenSSL cipher compatibility.
- Correctly handle disabled ciphers. (CVE-2015-5244)
- Implement a slew more OpenSSL cipher macros.
- Fix a number of illegal memory accesses and memory leaks.
- Support for SHA384 ciphers if they are available in NSS.
- Add compatibility for mod_ssl-style cipher definitions.
- Add TLSv1.2-specific ciphers.
- Completely remove support for SSLv2.
- Add support for sqlite NSS databases.
- Compare subject CN and VS hostname during server start up.
- Add support for enabling TLS v1.2.
- Don't enable SSL 3 by default. (CVE-2014-3566)
- Fix CVE-2013-4566.
- Move nss_pcache to /usr/libexec.
- Support httpd 2.4+.
- Use apache2-systemd-ask-pass to prompt for a certificate passphrase. (bsc#972968, bsc#975394)
- Record
SUSE-SU-2016:2285-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:2396-1 No score
Security update for apache2-mod_nss
This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements:
- Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)
- Created valgrind suppression files to ease debugging.
- Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.
- Improvements to migrate.pl.
- Update default ciphers to something more modern and secure.
- Check for host and netstat commands in gencert before trying to use them.
- Add server support for DHE ciphers.
- Extract SAN from server/client certificates into env
- Fix memory leaks and other coding issues caught by clang analyzer.
- Add support for Server Name Indication (SNI).
- Add support for SNI for reverse proxy connections.
- Add RenegBufferSize? option.
- Add support for TLS Session Tickets (RFC 5077).
- Fix logical AND support in OpenSSL cipher compatibility.
- Correctly handle disabled ciphers. (CVE-2015-5244)
- Implement a slew more OpenSSL cipher macros.
- Fix a number of illegal memory accesses and memory leaks.
- Support for SHA384 ciphers if they are available in NSS.
- Add compatibility for mod_ssl-style cipher definitions.
- Add TLSv1.2-specific ciphers.
- Completely remove support for SSLv2.
- Add support for sqlite NSS databases.
- Compare subject CN and VS hostname during server start up.
- Add support for enabling TLS v1.2.
- Don't enable SSL 3 by default. (CVE-2014-3566)
- Fix CVE-2013-4566.
- Move nss_pcache to /usr/libexec.
- Support httpd 2.4+.
- SHA256 cipher names change spelling from *_sha256 to *_sha_256.
- Use apache2-systemd-ask-pass to prompt for a certificate passphrase. (bsc#972968, bsc#975394)
- Record
SUSE-SU-2016:2396-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-mod_nssMageia:5 |
before 1.0.14-1.2.mga5 | 1.0.14-1.2.mga5 |
mod_nssRed Hat:enterprise_linux:7::client |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
mod_nss-debuginfoRed Hat:enterprise_linux:7::client |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
mod_nssRed Hat:enterprise_linux:7::computenode |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
mod_nss-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
mod_nssRed Hat:enterprise_linux:7::server |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
mod_nss-debuginfoRed Hat:enterprise_linux:7::server |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
mod_nssRed Hat:enterprise_linux:7::workstation |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
mod_nss-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:1.0.14-7.el7 | 0:1.0.14-7.el7 |
apache2-mod_nssSUSE:Linux Enterprise Server 12 SP1 |
before 1.0.14-18.3 | 1.0.14-18.3 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache2-mod_nssSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.0.14-18.3 | 1.0.14-18.3 |
apache2-mod_nssSUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.0.14-10.14.3 | 1.0.14-10.14.3 |
apache2-mod_nssSUSE:Linux Enterprise Server 12-LTSS |
before 1.0.14-10.14.3 | 1.0.14-10.14.3 |
libapache2-mod-nssUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.11-11.0.12-11.0.12-2 |
None known |
apache2-mod_nssopenSUSE:Tumbleweed |
before 1.0.14-4.1 | 1.0.14-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-3099 is a high vulnerability (CVSS 7.5) in Redhat Enterprise Linux Desktop, published May 21, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. Fixed in apache-mod_nss 1.0.14-1.2.mga5.
References
lists.fedoraproject.org/pipermail/package-announce/2016-April/183102.html
bugzilla.redhat.com/show_bug.cgi?id=1319052
rhn.redhat.com/errata/RHSA-2016-2602.html
nvd.nist.gov/vuln/detail/CVE-2016-3099
Show 27 moreShow less
access.redhat.com/errata/RHSA-2016:2602
github.com/advisories/GHSA-6rg6-w3xx-cvm5
advisories.mageia.org/MGASA-2016-0197.html
bugs.mageia.org/show_bug.cgi?id=18276
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2602.json
cve.org/CVERecord?id=CVE-2016-3099
suse.com/support/update/announcement/2016/suse-su-20162285-1
bugzilla.suse.com/972968
ubuntu.com/security/CVE-2016-3099