CVSS 3.1
3.7 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-310, CWE-295
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:iphone_os
- apple:mac_os_x
- apple:safari
- canonical:ubuntu_linux
- debian:debian_linux
- google:chrome
- hp:hp-ux
- ibm:content_manager
- microsoft:internet_explorer
- mozilla:firefox
- mozilla:firefox_esr
- mozilla:firefox_os
- mozilla:network_security_services
- mozilla:seamonkey
- mozilla:thunderbird
- openssl:openssl
- opera:opera_browser
- oracle:jdk
- oracle:jre
- oracle:jrockit
- oracle:sparc-opl_service_processor
- suse:linux_enterprise_desktop
- suse:linux_enterprise_server
- suse:linux_enterprise_software_development_kit
- suse:suse_linux_enterprise_server
References
- http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc
- http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery
- http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778