Lucene search
MitreCVE-2008-7270HistoryDec 06, 2010 - 10:30 p.m.
CVE-2008-7270
2010-12-0622:30:31
CWE-310
mitre
web.nvd.nist.gov
57
cve-2008-7270
openssl
ssl
vulnerability
network traffic
session identifier
nvd
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
8.1
Confidence
High
EPSS
0.008
Percentile
81.7%
OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.
Affected configurations
Node
opensslopensslRangeā¤0.9.8i
ORopensslopensslMatch0.9.1c
ORopensslopensslMatch0.9.2b
ORopensslopensslMatch0.9.3
ORopensslopensslMatch0.9.3a
ORopensslopensslMatch0.9.4
ORopensslopensslMatch0.9.5
ORopensslopensslMatch0.9.5beta1
ORopensslopensslMatch0.9.5beta2
ORopensslopensslMatch0.9.5a
ORopensslopensslMatch0.9.5abeta1
ORopensslopensslMatch0.9.5abeta2
ORopensslopensslMatch0.9.6
ORopensslopensslMatch0.9.6beta1
ORopensslopensslMatch0.9.6beta2
ORopensslopensslMatch0.9.6beta3
ORopensslopensslMatch0.9.6a
ORopensslopensslMatch0.9.6abeta1
ORopensslopensslMatch0.9.6abeta2
ORopensslopensslMatch0.9.6abeta3
ORopensslopensslMatch0.9.6b
ORopensslopensslMatch0.9.6c
ORopensslopensslMatch0.9.6d
ORopensslopensslMatch0.9.6e
ORopensslopensslMatch0.9.6f
ORopensslopensslMatch0.9.6g
ORopensslopensslMatch0.9.6h
ORopensslopensslMatch0.9.6i
ORopensslopensslMatch0.9.6j
ORopensslopensslMatch0.9.6k
ORopensslopensslMatch0.9.6l
ORopensslopensslMatch0.9.6m
ORopensslopensslMatch0.9.7
ORopensslopensslMatch0.9.7beta1
ORopensslopensslMatch0.9.7beta2
ORopensslopensslMatch0.9.7beta3
ORopensslopensslMatch0.9.7beta4
ORopensslopensslMatch0.9.7beta5
ORopensslopensslMatch0.9.7beta6
ORopensslopensslMatch0.9.7a
ORopensslopensslMatch0.9.7b
ORopensslopensslMatch0.9.7c
ORopensslopensslMatch0.9.7d
ORopensslopensslMatch0.9.7e
ORopensslopensslMatch0.9.7f
ORopensslopensslMatch0.9.7g
ORopensslopensslMatch0.9.7h
ORopensslopensslMatch0.9.7i
ORopensslopensslMatch0.9.7j
ORopensslopensslMatch0.9.7k
ORopensslopensslMatch0.9.7l
ORopensslopensslMatch0.9.7m
ORopensslopensslMatch0.9.8
ORopensslopensslMatch0.9.8a
ORopensslopensslMatch0.9.8b
ORopensslopensslMatch0.9.8c
ORopensslopensslMatch0.9.8d
ORopensslopensslMatch0.9.8e
ORopensslopensslMatch0.9.8f
ORopensslopensslMatch0.9.8g
ORopensslopensslMatch0.9.8h
| Vendor | Product | Version | CPE |
|---|---|---|---|
| openssl | openssl | * | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
| openssl | openssl | 0.9.1c | cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:* |
| openssl | openssl | 0.9.2b | cpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:*:* |
| openssl | openssl | 0.9.3 | cpe:2.3:a:openssl:openssl:0.9.3:*:*:*:*:*:*:* |
| openssl | openssl | 0.9.3a | cpe:2.3:a:openssl:openssl:0.9.3a:*:*:*:*:*:*:* |
| openssl | openssl | 0.9.4 | cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:*:* |
| openssl | openssl | 0.9.5 | cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:*:* |
| openssl | openssl | 0.9.5 | cpe:2.3:a:openssl:openssl:0.9.5:beta1:*:*:*:*:*:* |
| openssl | openssl | 0.9.5 | cpe:2.3:a:openssl:openssl:0.9.5:beta2:*:*:*:*:*:* |
| openssl | openssl | 0.9.5a | cpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:*:* |
References
cvs.openssl.org/chngview?cn=17489
marc.info/?l=bugtraq&m=132077688910227&w=2
secunia.com/advisories/42493
ubuntu.com/usn/usn-1029-1
www.redhat.com/support/errata/RHSA-2010-0977.html
www.redhat.com/support/errata/RHSA-2010-0978.html
www.redhat.com/support/errata/RHSA-2011-0896.html
www.securityfocus.com/archive/1/522176
www.securityfocus.com/bid/45254
bugzilla.redhat.com/show_bug.cgi?id=659462
Related
f5
f5
K12853 : OpenSSL vulnerability CVE-2008-7270
2013-09-04 00:00:00
SOL12853 - OpenSSL vulnerability CVE-2008-7270
2011-05-24 00:00:00
SOL12543 - OpenSSL vulnerability CVE-2010-4180
2011-01-26 00:00:00
nessus
nessus
CentOS 5 : openssl (CESA-2010:0978)
2010-12-14 00:00:00
RHEL 5 : openssl (RHSA-2010:0978)
2010-12-14 00:00:00
openvas
openvas
CentOS Update for openssl CESA-2010:0978 centos5 i386
2011-08-09 00:00:00
RedHat Update for openssl RHSA-2010:0978-01
2010-12-28 00:00:00
Ubuntu Update for openssl vulnerabilities USN-1029-1
2010-12-23 00:00:00
ubuntu
ubuntu
OpenSSL vulnerabilities
2010-12-08 00:00:00
debiancve
debiancve
CVE-2008-7270
2010-12-06 22:30:31
CVE-2010-4180
2010-12-06 21:05:48
prion
prion
Session fixation
2010-12-06 22:30:00
Session fixation
2010-12-06 21:05:00
cvelist
cvelist
CVE-2008-7270
2010-12-06 22:00:00
CVE-2010-4180
2010-12-06 21:00:00
centos
centos
openssl security update
2010-12-14 01:19:08
openssl security update
2011-01-27 09:11:13
securityvulns
securityvulns
[USN-1029-1] OpenSSL vulnerabilities
2010-12-09 00:00:00
[security bulletin] HPSBPV02891 rev.1 - HP ProCurve Switches, Remote Unauthorized Information Disclosure
2013-07-16 00:00:00
OpenSSL protection level downgrade
2010-12-09 00:00:00
ubuntucve
ubuntucve
CVE-2008-7270
2010-12-06 00:00:00
CVE-2010-4180
2010-12-06 00:00:00
oraclelinux
oraclelinux
openssl security update
2010-12-13 00:00:00
openssl security update
2010-12-13 00:00:00
openssl security update
2011-02-10 00:00:00
osv
osv
Red Hat Security Advisory: openssl security update
2024-09-15 18:49:31
Red Hat Security Advisory: openssl security update
2024-09-15 18:49:26
Red Hat Security Advisory: openssl security update
2024-09-15 18:49:35
redhat
redhat
(RHSA-2010:0978) Moderate: openssl security update
2010-12-13 00:00:00
(RHSA-2010:0977) Moderate: openssl security update
2010-12-13 00:00:00
(RHSA-2010:0979) Moderate: openssl security update
2010-12-13 00:00:00
nvd
nvd
CVE-2008-7270
2010-12-06 22:30:31
CVE-2010-4180
2010-12-06 21:05:48
veracode
veracode
Insecure TLS Configuration
2020-04-10 00:56:25
Insecure TLS Configuration
2020-04-10 00:56:26
openssl
openssl
Vulnerability in OpenSSL CVE-2010-4180
2010-12-02 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package openssl10 version 1.0.0c-alt1
2011-02-01 00:00:00
Security fix for the ALT Linux 8 package openssl10 version 1.0.0c-alt1
2011-02-01 00:00:00
Security fix for the ALT Linux 7 package openssl10 version 1.0.0c-alt1
2011-02-01 00:00:00
cve
cve
CVE-2010-4180
2010-12-06 21:05:48
slackware
slackware
[slackware-security] openssl
2010-12-07 07:14:58
fedora
fedora
[SECURITY] Fedora 14 Update: openssl-1.0.0c-1.fc14
2010-12-10 20:26:33
[SECURITY] Fedora 14 Update: openssl-1.0.0d-1.fc14
2011-02-14 20:28:21
[SECURITY] Fedora 13 Update: openssl-1.0.0c-1.fc13
2010-12-17 08:35:37
debian
debian
[SECURITY] [DSA-2141-1] New openssl packages fix protocol design flaw
2011-01-05 23:18:09
[SECURITY] [DSA-2141-1] New openssl packages fix protocol design flaw
2011-01-05 23:18:09
suse
suse
compat-openssl097g (important)
2011-07-27 16:08:25
Security update for compat-openssl097g (important)
2011-07-27 17:08:16
cert
cert
lenovo
lenovo
IntelĀ® PROSet/Wireless WiFi Software Vulnerabilities - US
2018-11-13 17:10:51
IntelĀ® PROSet/Wireless WiFi Software Vulnerabilities - Lenovo Support US
2018-11-13 17:10:51
gentoo
gentoo
OpenSSL: Multiple vulnerabilities
2011-10-09 00:00:00
ibm
ibm
vmware
vmware
VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
2011-10-27 00:00:00
VMware third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
2011-10-27 00:00:00
VMware vSphere and vCOps updates to third party libraries
2012-08-30 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
8.1
Confidence
High
EPSS
0.008
Percentile
81.7%
Related for CVE-2008-7270