Direct naar de inhoud
⚡ Kritieke cyberalerts voor jouw sector & systemen — direct in je inbox. Aanmelden →
cybernieuws.nl Cybersecurity en informatiebeveiling nieuws alerts live · 2 min 162 bronnen
CVE's Videos Dagbriefing

← Terug naar CVE-database

CVE-2015-4000

LOW · 3.7 CVSS Gepubliceerd: CWE-310

Beschrijving

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

Vendors

Openssl Canonical Hp Ibm Oracle Debian Suse Apple Mozilla Google Microsoft Opera

Affected products

Openssl Ubuntu Linux Hp-ux Content Manager Jrockit Debian Linux Jdk Jre Linux Enterprise Desktop Linux Enterprise Server Linux Enterprise Software Development Kit Suse Linux Enterprise Server Iphone Os Mac Os X Network Security Services Sparc-opl Service Processor Safari Chrome Internet Explorer Firefox Opera Browser Firefox Esr Seamonkey Thunderbird Firefox Os

References