OpenSSL: SSLv2 doesn't block disabled ciphers

A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks...

SUSE-SU-2016:0620-1 Security update for openssl

This update for openssl fixes various security issues: Security issues fixed: - CVE-2016-0800 aka the 'DROWN' attack bsc968046: OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a...

SUSE-SU-2016:0621-1 Security update for openssl

This update for openssl fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the 'DROWN' attack bsc968046: OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a...

Security fix for the ALT Linux 8 package openssl10 version 1.0.2g-alt1

March 1, 2016 Gleb Fotengauer-Malinovskiy 1.0.2g-alt1 - Updated to 1.0.2g fixes CVE-2016-0701 CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800. - Added default ciphers to system profile...

Security fix for the ALT Linux 9 package openssl1.1 version 1.0.2g-alt1

March 1, 2016 Gleb Fotengauer-Malinovskiy 1.0.2g-alt1 - Updated to 1.0.2g fixes CVE-2016-0701 CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800. - Added default ciphers to system profile...

Security fix for the ALT Linux 9 package openssl10 version 1.0.2g-alt1

March 1, 2016 Gleb Fotengauer-Malinovskiy 1.0.2g-alt1 - Updated to 1.0.2g fixes CVE-2016-0701 CVE-2016-0702 CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800. - Added default ciphers to system profile...

Debian DLA-421-1 : openssl security update

CVE-2015-3197: A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via SSLOPNOSSLv2. Additionally, when using a DHE cipher suite a ne...

Apache Traffic Server 5.1.x < 5.1.1 Multiple Vulnerabilities (POODLE)

Binary data 9081.prm...

CVE-2015-3197

ssl/s2srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the getclientmasterkey and...

DEBIAN-CVE-2015-3197

ssl/s2srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the getclientmasterkey and...

GLSA-201601-05 : OpenSSL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201601-05 OpenSSL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in OpenSSL. Please review the upstream advisory and CVE identifiers referenced below for details. Note that the list includes CVE identifier...

openssl: man-in-the-middle

CVE-2015-3197 man-in-the-middle A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. -...

lib32-openssl: man-in-the-middle

CVE-2015-3197 man-in-the-middle A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. -...

January 2016 OpenSSL Patch Diffie Hellman Safe Primes

The OpenSSL project team today patched two vulnerabilities in the crypto library, one of which is rated high severity. The patches are in new releases of OpenSSL, 1.0.1r and 1.0.2f, and were made along with an enhancement to the strength of the cryptography in a previous mitigation for last year’...

DEBIAN-CVE-2015-3276

The nssparseciphers function in libraries/libldap/tlsm.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors...

AZL-6770 CVE-2015-3276 affecting package openldap for versions less than 2.4.57-5

The nssparseciphers function in libraries/libldap/tlsm.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors...

openldap: incorrect multi-keyword mode cipherstring parsing

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled...

ssl-enum-ciphers NSE Script

This script repeatedly initiates SSLv3/TLS connections, each time trying a new cipher or compressor while recording whether a host accepts or rejects it. The end result is a list of all the ciphersuites and compressors that a server accepts. Each ciphersuite is shown with a letter grade A through...

SUSE SLES12 Security Update : apache2 (SUSE-SU-2015:1851-1) (Logjam)

The Apache2 webserver was updated to fix several issues : Security issues fixed : - The chunked transfer coding implementation in the Apache HTTP Server did not properly parse chunk headers, which allowed remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to...

389 Directory Server nsSSL3Ciphers Preference Vulnerability

389 Directory Server is an LDAP server developed by Red Hat. A preference vulnerability exists in 389 Directory Server nsSSL3Ciphers, which could allow a remote attacker to perform a security attack by requesting the use of a disabled cipherset...