CVEvulnerability
CVE-2015-4000
3.7 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-05-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS 3.0 ([email protected])
- 3.7 LOW — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-295, CWE-310
Description
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Affected configurations
• openssl openssl (>= 1.0.1 <= 1.0.1m)
• openssl openssl (>= 1.0.2 <= 1.0.2a)
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 14.10
• canonical ubuntu linux 15.04
• openssl openssl (<= 1.0.1m)
• hp hp-ux b.11.31
• ibm content manager 8.5
• oracle jrockit r28.3.6
• debian debian linux 7.0
• debian debian linux 8.0
• oracle jdk 1.6.0
• oracle jdk 1.7.0
• oracle jdk 1.8.0
• oracle jre 1.6.0
• oracle jre 1.7.0
• oracle jre 1.8.0
• suse linux enterprise desktop 12
• suse linux enterprise server 11.0
• suse linux enterprise software development kit 12
• suse suse linux enterprise server 12
• apple iphone os (<= 8.3)
• apple mac os x (<= 10.10.3)
• mozilla network security services 3.19
• oracle sparc-opl service processor (<= 1121)
• apple safari
• google chrome
• microsoft internet explorer
• mozilla firefox
• opera opera browser
• mozilla firefox 38.1.0
• mozilla firefox 39.0
• mozilla firefox esr 31.8
• mozilla seamonkey 2.35
• mozilla thunderbird 31.8
• mozilla thunderbird 38.1
• mozilla firefox os 2.2
Related
Weakness · not in database (1)
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc Third Party Advisory
- http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery Third Party Advisory
- http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc Mailing List, Third Party Advisory
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402 Third Party Advisory
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778 Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681 Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 Third Party Advisory
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html Mailing List, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00016.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00094.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00097.html Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143506486712441&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143557934009303&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143558092609708&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143628304012255&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143637549705650&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143655800220052&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143880121627664&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144043644216842&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144050121701297&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144060576831314&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144060606031437&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144061542602287&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144069189622016&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144102017024820&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144104533800819&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144493176821532&w=2 Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=145409266329539&w=2 Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2015/05/20/8 Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1072.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1185.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1197.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1228.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1229.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1230.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1241.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1242.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1243.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1485.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1486.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1488.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1526.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1544.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1604.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1624.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2056.html Third Party Advisory
- http://support.apple.com/kb/HT204941 Third Party Advisory
- http://support.apple.com/kb/HT204942 Third Party Advisory
- http://support.citrix.com/article/CTX201114 Third Party Advisory