Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-4000


The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.


Published

2015-05-21T00:59:00.087

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 3.7 (LOW)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-310

Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openssl openssl ≤ 1.0.1m Yes
Application openssl openssl ≤ 1.0.2a Yes
Operating System canonical ubuntu_linux 12.04 Yes
Operating System canonical ubuntu_linux 14.04 Yes
Operating System canonical ubuntu_linux 14.10 Yes
Operating System canonical ubuntu_linux 15.04 Yes
Application openssl openssl ≤ 1.0.1m Yes
Operating System hp hp-ux b.11.31 Yes
Application ibm content_manager 8.5 Yes
Application oracle jrockit r28.3.6 Yes
Operating System debian debian_linux 7.0 Yes
Operating System debian debian_linux 8.0 Yes
Application oracle jdk 1.6.0 Yes
Application oracle jdk 1.7.0 Yes
Application oracle jdk 1.7.0 Yes
Application oracle jdk 1.8.0 Yes
Application oracle jdk 1.8.0 Yes
Application oracle jre 1.6.0 Yes
Application oracle jre 1.7.0 Yes
Application oracle jre 1.7.0 Yes
Application oracle jre 1.8.0 Yes
Application oracle jre 1.8.0 Yes
Operating System suse linux_enterprise_desktop 12 Yes
Operating System suse linux_enterprise_server 11.0 Yes
Operating System suse linux_enterprise_software_development_kit 12 Yes
Operating System suse suse_linux_enterprise_server 12 Yes
Operating System apple iphone_os ≤ 8.3 Yes
Operating System apple mac_os_x ≤ 10.10.3 Yes
Application mozilla network_security_services 3.19 Yes
Application oracle sparc-opl_service_processor ≤ 1121 Yes
Application apple safari - Yes
Application google chrome - Yes
Application microsoft internet_explorer - Yes
Application mozilla firefox - Yes
Application opera opera_browser - Yes
Application mozilla firefox 38.1.0 Yes
Application mozilla firefox 39.0 Yes
Application mozilla firefox_esr 31.8 Yes
Application mozilla seamonkey 2.35 Yes
Application mozilla thunderbird 31.8 Yes
Application mozilla thunderbird 38.1 Yes
Operating System mozilla firefox_os 2.2 Yes

References