NetSight
IP …
low3.7

CVE-2020-1968

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have…

Impact

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

Affected products

VendorProductAffected versions
OpensslOpenssl
from 1.0.2 through 1.0.2v
CanonicalUbuntu Linux
Versions 16.04, 18.04
DebianDebian Linux
Version 9.0
OracleJd Edwards World Security
Version a9.4
OraclePeoplesoft Enterprise Peopletools
Versions 8.56, 8.57, 8.58
OracleEthernet Switch Es2-64 Firmware
Version 2.0.0.14
OracleEthernet Switch Es2-72 Firmware
Version 2.0.0.14
FujitsuM10-1 Firmware
before xcp2400
before xcp3100
FujitsuM10-4 Firmware
before xcp2400
before xcp3100
FujitsuM10-4s Firmware
before xcp2400
before xcp3100
FujitsuM12-1 Firmware
before xcp2400
before xcp3100
FujitsuM12-2 Firmware
before xcp2400
before xcp3100

Weakness classification

CWE-203

References