CVE-2011-5095

OpenSSL 0.9.8 - Shared Secret Key Exposure via Improper Public Parameter Validation

Title source: llm
STIX 2.1

Description

The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-1923.

References (3)

Core 3
Core References
Various Sources x_refsource_misc
http://www.cl.cam.ac.uk/~rja14/Papers/psandqs.pdf
Various Sources x_refsource_misc
https://discussions.nessus.org/thread/3381

Scores

EPSS 0.0032
EPSS Percentile 54.9%

Details

CWE
CWE-310
Status published
Products (1)
openssl/openssl 0.9.8
Published Jun 20, 2012
Tracked Since Feb 18, 2026