Vulnerability record · CVE-2016-8212 · published 3 February 2017
CVE-2016-8212: Dell bsafe crypto-j improper resource shutdown vulnerability
Dell · Bsafe Crypto J
An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.
Description
An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/archive/1/540066/30/0/threaded | Mailing ListThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/95831 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1037732 | Third Party AdvisoryVDB Entry |
| http://www.securityfocus.com/archive/1/540066/30/0/threaded | Mailing ListThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/95831 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1037732 | Third Party AdvisoryVDB Entry |
Track CVE-2016-8212 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-8212), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.