CVE-2015-4000

LOW

Openssl < 1.0.1m - Cryptographic Issue

Title source: rule

Description

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

Exploits (1)

nomisec WRITEUP 6 stars
by fatlan · poc
https://github.com/fatlan/HAProxy-Keepalived-Sec-HighLoads

References (217)

... and 197 more

Scores

CVSS v3 3.7
EPSS 0.9374
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-310
Status published
Products (36)
apple/iphone_os < 8.3
apple/mac_os_x < 10.10.3
apple/safari
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 14.10
canonical/ubuntu_linux 15.04
debian/debian_linux 7.0
debian/debian_linux 8.0
google/chrome
... and 26 more
Published May 21, 2015
Tracked Since Feb 18, 2026