CVE-2015-8838

MEDIUM

Php < 5.4.42 - Improper Access Control

Title source: rule

Description

ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.

References (9)

[Various Sources] http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=97aa752fee61fccdec361279adbfb17a3c60f3f4

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html

[Various Sources] http://php.net/ChangeLog-5.php

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2952-1

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2952-2

[Various Sources] https://bugs.php.net/bug.php?id=69669

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html

Scores

CVSS v3 5.9

EPSS 0.0066

EPSS Percentile 70.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Classification

CWE

CWE-284

Status draft

Affected Products (50)

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

php/php

... and 35 more

Timeline

Published May 16, 2016

Tracked Since Feb 18, 2026