low3.7
CVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which…
Impact
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openssl | Openssl | from 1.0.1 through 1.0.1m from 1.0.2 through 1.0.2a through 1.0.1m |
| Canonical | Ubuntu Linux | Versions 12.04, 14.04, 14.10, 15.04 |
| Hp | Hp-Ux | Version b.11.31 |
| Ibm | Content Manager | Version 8.5 |
| Oracle | Jrockit | Version r28.3.6 |
| Debian | Debian Linux | Versions 7.0, 8.0 |
| Oracle | Jdk | Versions 1.6.0, 1.7.0, 1.8.0 |
| Oracle | Jre | Versions 1.6.0, 1.7.0, 1.8.0 |
| Suse | Linux Enterprise Desktop | Version 12 |
| Suse | Linux Enterprise Server | Version 11.0 |
| Suse | Linux Enterprise Software Development Kit | Version 12 |
| Suse | Suse Linux Enterprise Server | Version 12 |
Weakness classification
References
- NVD record
- CVE.org record
- http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc
- http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery
- http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html