Back
CVE-2016-0270
IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce…
Medium5.9EPSS 3.1%
- Published
- Updated
- Reserved
- Assigned by
- ibm
Description
IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Medium5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 3.1% · top 12% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
Affected products
n/a
- affected n/a
References (7)
- 96062 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- http://www-01.ibm.com/support/docview.wss?uid=swg21979604 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/nonce-disrespect/nonce-disrespect (opens in a new tab)x_refsource_MISCx_transferred
- http://www-01.ibm.com/support/docview.wss?uid=swg21979673 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://support.citrix.com/article/CTX220329 (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://www-01.ibm.com/support/docview.wss?uid=swg21979669 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 1037795 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2016-0270)Record last updated .