Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2015-4000
HistoryMay 21, 2015 - 12:59 a.m.

CVE-2015-4000

2015-05-2100:59:00
CWE-310
[email protected]
web.nvd.nist.gov
872
In Wild
2
cve-2015-4000
tls protocol
dhe_export
cipher-downgrade
logjam
nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.8 Medium

AI Score

Confidence

High

0.974 High

EPSS

Percentile

99.9%

JSON

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the “Logjam” issue.

Affected configurations

NVD
Node
opensslopensslRange1.0.1–1.0.1m
OR
opensslopensslRange1.0.2–1.0.2a
Node
canonicalubuntu_linuxMatch12.04lts
OR
canonicalubuntu_linuxMatch14.04lts
OR
canonicalubuntu_linuxMatch14.10
OR
canonicalubuntu_linuxMatch15.04
Node
opensslopensslRange≤1.0.1m
AND
hphp-uxMatchb.11.31
Node
ibmcontent_managerMatch8.5enterprise
Node
oraclejrockitMatchr28.3.6
Node
debiandebian_linuxMatch7.0
OR
debiandebian_linuxMatch8.0
Node
oraclejdkMatch1.6.0update95
OR
oraclejdkMatch1.7.0update75
OR
oraclejdkMatch1.7.0update80
OR
oraclejdkMatch1.8.0update_33
OR
oraclejdkMatch1.8.0update45
OR
oraclejreMatch1.6.0update_95
OR
oraclejreMatch1.7.0update_75
OR
oraclejreMatch1.7.0update_80
OR
oraclejreMatch1.8.0update_33
OR
oraclejreMatch1.8.0update_45
Node
suselinux_enterprise_desktopMatch12
OR
suselinux_enterprise_serverMatch11.0sp4
OR
suselinux_enterprise_software_development_kitMatch12
OR
susesuse_linux_enterprise_serverMatch12
Node
appleiphone_osRange≤8.3
OR
applemac_os_xRange≤10.10.3
Node
mozillanetwork_security_servicesMatch3.19
Node
oraclesparc-opl_service_processorRange≤1121
Node
applesafariMatch-
OR
googlechromeMatch-
OR
microsoftinternet_explorerMatch-
OR
mozillafirefoxMatch-
OR
operaopera_browserMatch-
Node
mozillafirefoxMatch39.0
OR
mozillafirefox_esrMatch31.8
OR
mozillafirefox_esrMatch38.1.0
OR
mozillaseamonkeyMatch2.35
OR
mozillathunderbirdMatch31.8
OR
mozillathunderbirdMatch38.1
OR
mozillafirefox_osMatch2.2

References

Social References

More

Related

oraclelinux 2
redhat 1
nessus 33
f5 2
atlassian 6
openvas 30
threatpost 1
fedora 6
ubuntucve 1
ibm 104
cvelist 1
nvd 1
suse 2
citrix 1
debian 1
amazon 1
cisa 1
mozilla 1
prion 1
aix 1
fortinet 1
debiancve 1
oraclelinux
oraclelinux
nss security update
2015-06-25 00:00:00
openssl security update
2015-06-04 00:00:00
redhat
redhat
(RHSA-2015:1072) Moderate: openssl security update
2015-06-04 00:00:00
nessus
nessus
AIX 7.1 TL 3 : sendmail (IV75646) (Logjam)
2015-08-11 00:00:00
AIX 6.1 TL 9 : sendmail (IV75643) (Logjam)
2015-08-11 00:00:00
SSH Diffie-Hellman Modulus <= 1024 Bits (Logjam)
2015-10-09 00:00:00
f5
f5
K16674 : TLS vulnerability CVE-2015-4000
2015-09-16 00:00:00
SOL16674 - TLS vulnerability CVE-2015-4000
2015-05-21 00:00:00
atlassian
atlassian
Update Java version bundled found in the installer to a version >= 1.8u51
2015-07-15 01:43:18
Update Java version bundled found in the installer to a version >= 1.8u51
2015-07-15 01:35:17
Update Java version bundled found in the installer to a version >= 1.8u51
2015-07-15 01:43:18
openvas
openvas
Oracle: Security Advisory (ELSA-2015-1072)
2015-10-06 00:00:00
Fedora Update for nss-softokn FEDORA-2015-9048
2015-07-07 00:00:00
Fedora Update for nss FEDORA-2015-9048
2015-07-07 00:00:00
threatpost
threatpost
OpenSSL Patches Five Flaws, Adds Protection Against Logjam Attack
2015-06-11 13:48:27
fedora
fedora
[SECURITY] Fedora 21 Update: nss-3.19.1-1.0.fc21
2015-06-01 17:06:26
[SECURITY] Fedora 22 Update: nss-softokn-3.19.1-1.0.fc22
2015-06-02 15:17:04
[SECURITY] Fedora 22 Update: nss-util-3.19.1-1.0.fc22
2015-06-02 15:17:04
ubuntucve
ubuntucve
CVE-2015-4000
2015-05-20 00:00:00
ibm
ibm
Security Bulletin: A security vulnerability has been identified in an IBM Tivoli Monitoring shared component shipped with Agent for NetApp Storage (CVE-2015-4000)
2018-07-23 07:35:29
Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects PowerKVM (CVE-2015-4000)
2018-06-18 01:28:37
Security Bulletin: IBM Spectrum Protect Plus vulnerable to Logjam (CVE-2015-4000)
2020-06-12 20:34:38
cvelist
cvelist
CVE-2015-4000
2015-05-21 00:00:00
nvd
nvd
CVE-2015-4000
2015-05-21 00:59:00
suse
suse
Security update for MySQL (important)
2015-07-10 19:08:04
Security update for MySQL (important)
2015-07-02 21:05:19
citrix
citrix
CVE-2015-4000 - Citrix Security Advisory for DHE_EXPORT TLS Vulnerability
2015-05-22 04:00:00
debian
debian
[SECURITY] [DLA 507-1] nss security update
2016-06-07 10:00:27
amazon
amazon
Medium: nss, nss-util
2015-07-22 10:00:00
cisa
cisa
OpenSSL Patches Multiple Vulnerabilities
2015-06-12 00:00:00
mozilla
mozilla
NSS accepts export-length DHE keys with regular DHE cipher suites — Mozilla
2015-07-02 00:00:00
prion
prion
Code injection
2015-05-21 00:59:00
aix
aix
Vulnerability in Diffie-Hellman ciphers affects sendmail on AIX,Vulnerability in Diffie-Hellman ciphers affects sendmail on VIOS
2015-08-07 15:15:59
fortinet
fortinet
CVE-2015-4000 "Logjam" attack
2015-05-20 00:00:00
debiancve
debiancve
CVE-2015-4000
2015-05-21 00:59:00

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

3.7 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.8 Medium

AI Score

Confidence

High

0.974 High

EPSS

Percentile

99.9%

JSON
Related for CVE-2015-4000
oraclelinux2redhat1nessus33f52atlassian6openvas30threatpost1fedora6ubuntucve1ibm104cvelist1nvd1suse2citrix1debian1amazon1cisa1mozilla1prion1aix1fortinet1debiancve1