CVE-2015-4000
45Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 3.7epss 100%
from disclosure to weapon0 days
Published on NVDMay 21
metasploitOct 14
exploitation probability
100%top 1% of all CVEs
observed exploitation
nono source reports it
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
n/a · n/aReferences
http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.aschttp://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgeryhttp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.aschttp://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Jun/msg00002.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html