JVN#23632449: OpenSSL version rollback vulnerability

Impact

When performing communication through a path controlled by an attacker using OpenSSL, the attacker conducting a man-in-the-middle (MITM) attack can force a client and a server to negotiate the SSL 2.0 protocol even if these parties both support SSL 3.0 or TLS 1.0 to intercept or alter data.

Solution

Products Affected

• OpenSSL 0.9.8 and earlier