CVE-2010-4180
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.
- EPSS
- 9.5% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- f5:nginx
- fedoraproject:fedora
- openssl:openssl
- opensuse:opensuse
- suse:linux_enterprise
- suse:linux_enterprise_desktop
- suse:linux_enterprise_server
References
- http://cvs.openssl.org/chngview?cn=20131
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777
- http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html