CVE-2015-4000

Description

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the Logjam issue.

Risk Information

Base Score
3.7
MODERATE
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score
Exploitation Probability
93.9

Associated Vulnerability

VulnerabilityOS Platform
Update for SeaMonkey (2.35)Windows
Update for Mozilla Firefox ESR (38.1.0)Windows
Update for Mozilla Firefox (39.0)Windows
Update for Mozilla Thunderbird (38.1.0)Windows
Update for Mozilla Firefox (39.0.3)Windows
Update for Mozilla Firefox ESR (38.1.1)Windows
Updates for Google Chrome (66.0.3359.170)Windows
Updates for Google Chrome (x64) (66.0.3359.170)Windows
Updates for Google Chrome (66.0.3359.181)Windows
Updates for Google Chrome (x64) (66.0.3359.181)Windows
Updates for Google Chrome (67.0.3396.62)Windows
Updates for Google Chrome (x64) (67.0.3396.62)Windows
Updates for Google Chrome (67.0.3396.79)Windows
Updates for Google Chrome (x64) (67.0.3396.79)Windows
Updates for Google Chrome (67.0.3396.87)Windows
Updates for Google Chrome (x64) (67.0.3396.87)Windows
Google Chrome (67.0.3396.99)Windows
Google Chrome (x64) (67.0.3396.99)Windows
Vulnerability CVE-2015-4000,CVE-2017-17821 are affected in Apple Safari 46Windows
Multiple Vulnerabilities are affected in Java SE Development Kit 1.8.0Windows
Multiple Vulnerabilities are affected in Mozilla Firefox (x64) 84.0Windows
Vulnerability CVE-2015-4000,CVE-2016-2183,CVE-2021-23839 are affected in OpenSSL 1.0.2Windows
Multiple Vulnerabilities are affected in IBM Sterling B2B Integrator 5.2Windows
Multiple Vulnerabilities are affected in IBM UrbanCode Deploy 6.0Windows
Multiple Vulnerabilities are affected in IBM Tivoli Monitoring 6.2.3Windows
Multiple Vulnerabilities are affected in IBM Cognos Controller 10.2.1Windows
Multiple Vulnerabilities are affected in Apple Safari 2.3Windows
Multiple Vulnerabilities are affected in IBM Cognos Controller 10.1Windows
Multiple Vulnerabilities are affected in IBM Cognos Controller 10.1.1Windows
Multiple Vulnerabilities are affected in IBM Cognos Controller 8.5Windows
Multiple Vulnerabilities are affected in IBM Cognos Controller 8.5.1Windows
Multiple Vulnerabilities are affected in IBM Cognos Controller 10.2Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac 2.2Mac
Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (39.0)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Firefox For Mac (39.0.3)Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (139.0)Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (139.0.1)Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (139.0.4)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac 31.8Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (38.1.0)Mac
Multiple Vulnerabilities are affected in Apple Safari for MAC 26.1Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 84.0Mac
Vulnerabilities CVE-2013-6674,CVE-2014-2018,CVE-2015-4000 are affected in SeaMonkey For Mac 2.35Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 38.1.0Mac
Vulnerabilities CVE-2015-4000 are affected in Firefox ESR for Mac 31.8Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 38.1.0Mac
Vulnerabilities CVE-2015-4000 are affected in Mozilla Firefox for Mac 2.2Mac
Vulnerabilities CVE-2015-4000 are affected in Mozilla Firefox for Mac 31.8Mac
Vulnerabilities CVE-2015-4000,CVE-2015-4495 are affected in Mozilla Firefox for Mac 39.0Mac
Vulnerabilities CVE-2015-4000 are affected in Mozilla Thunderbird for Mac 31.8Mac
Vulnerabilities CVE-2015-4000 are affected in Mozilla Thunderbird for Mac 38.1Mac
Vulnerabilities CVE-2013-6674,CVE-2014-2018,CVE-2015-4000 are affected in SeaMonkey For Mac 2.35Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac 31.8Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac 38.1Mac
SUSE-SU-2018:1768-1(SUSE Linux Enterprise Server 11-SP4 ) nagios-nrpe-2.12-24.4.10.3.3.x86_64.rpmLinux
SUSE-SU-2018:1768-1(SUSE Linux Enterprise Server 11-SP4 ) nagios-nrpe-doc-2.12-24.4.10.3.3.x86_64.rpmLinux
SUSE-SU-2018:1768-1(SUSE Linux Enterprise Server 11-SP4 ) nagios-plugins-nrpe-2.12-24.4.10.3.3.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Desktop 12-SP1 ) libldap-2_4-2-2.4.41-18.13.1.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Desktop 12-SP1 ) libldap-2_4-2-32bit-2.4.41-18.13.1.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Desktop 12-SP1 ) libldap-2_4-2-debuginfo-2.4.41-18.13.1.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Desktop 12-SP1 ) libldap-2_4-2-debuginfo-32bit-2.4.41-18.13.1.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Server 12-SP1 ) openldap2-2.4.41-18.13.4.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Server 12-SP1 ) openldap2-back-meta-2.4.41-18.13.4.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Server 12-SP1 ) openldap2-back-meta-debuginfo-2.4.41-18.13.4.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Desktop 12-SP1 ) openldap2-client-2.4.41-18.13.1.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Desktop 12-SP1 ) openldap2-client-debuginfo-2.4.41-18.13.1.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Desktop 12-SP1 ) openldap2-client-debugsource-2.4.41-18.13.1.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Server 12-SP1 ) openldap2-debuginfo-2.4.41-18.13.4.x86_64.rpmLinux
SUSE-SU-2016:0224-1(SUSE Linux Enterprise Server 12-SP1 ) openldap2-debugsource-2.4.41-18.13.4.x86_64.rpmLinux
SUSE-SU-2016:0344-1(SUSE Linux Enterprise Desktop 12-SP1 ) socat-1.7.2.4-3.1.x86_64.rpmLinux
SUSE-SU-2016:0344-1(SUSE Linux Enterprise Desktop 12-SP1 ) socat-debuginfo-1.7.2.4-3.1.x86_64.rpmLinux
SUSE-SU-2016:0344-1(SUSE Linux Enterprise Desktop 12-SP1 ) socat-debugsource-1.7.2.4-3.1.x86_64.rpmLinux
SUSE-SU-2016:1618-1(SUSE Linux Enterprise Server 11-SP4 ) libmysqlclient15-5.0.96-0.8.10.3.x86_64.rpmLinux
SUSE-SU-2016:1618-1(SUSE Linux Enterprise Server 11-SP4 ) libmysqlclient15-32bit-5.0.96-0.8.10.3.x86_64.rpmLinux
SUSE-SU-2016:1618-1(SUSE Linux Enterprise Server 11-SP4 ) libmysqlclient_r15-5.0.96-0.8.10.3.x86_64.rpmLinux
SUSE-SU-2016:2385-1(SUSE Linux Enterprise Server 11-SP4 ) libtcnative-1-0-1.3.3-12.4.1.x86_64.rpmLinux
SUSE-SU-2015:1177-1(SUSE Linux Enterprise Desktop 11 SP3 ) libmysqlclient15-5.0.96-0.8.8.1.x86_64.rpmLinux
SUSE-SU-2015:1177-1(SUSE Linux Enterprise Desktop 11 SP3 ) libmysqlclient15-32bit-5.0.96-0.8.8.1.x86_64.rpmLinux
SUSE-SU-2015:1177-1(SUSE Linux Enterprise Desktop 11 SP3 ) libmysqlclient_r15-5.0.96-0.8.8.1.x86_64.rpmLinux
SUSE-SU-2015:1177-1(SUSE Linux Enterprise Desktop 11 SP3 ) libmysqlclient_r15-32bit-5.0.96-0.8.8.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-debuginfo-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-debugsource-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-doc-2.4.10-14.10.1.noarch.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-example-pages-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_auth_kerb-5.4-2.4.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_auth_kerb-debuginfo-5.4-2.4.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_auth_kerb-debugsource-5.4-2.4.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_jk-1.2.40-2.6.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_jk-debuginfo-1.2.40-2.6.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_jk-debugsource-1.2.40-2.6.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_security2-2.8.0-3.4.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_security2-debuginfo-2.8.0-3.4.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-mod_security2-debugsource-2.8.0-3.4.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-prefork-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-prefork-debuginfo-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-utils-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-utils-debuginfo-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-worker-2.4.10-14.10.1.x86_64.rpmLinux
SUSE-SU-2015:1851-1(SUSE Linux Enterprise Server 12 ) apache2-worker-debuginfo-2.4.10-14.10.1.x86_64.rpmLinux
Updates for Google Chrome (66.0.3359.170) (For Ubuntu)Linux
Updates for Google Chrome (66.0.3359.170) (For Debian)Linux
Updates for Google Chrome (66.0.3359.181) (For Debian)Linux
Updates for Google Chrome (67.0.3396.62) (For Debian)Linux
Updates for Google Chrome (67.0.3396.79) (For Debian)Linux
Updates for Google Chrome (67.0.3396.87) (For Debian)Linux
Google Chrome (67.0.3396.99) (For Debian)Linux
Updates for Google Chrome (66.0.3359.170) (For Centos)Linux
Updates for Google Chrome (66.0.3359.181) (For Centos)Linux
Updates for Google Chrome (67.0.3396.62) (For Centos)Linux
Updates for Google Chrome (67.0.3396.79) (For Centos)Linux
Updates for Google Chrome (67.0.3396.87) (For Centos)Linux
Google Chrome (67.0.3396.99) (For Centos)Linux
Updates for Google Chrome (66.0.3359.170) (For RedHat)Linux
Updates for Google Chrome (66.0.3359.181) (For RedHat)Linux
Updates for Google Chrome (67.0.3396.62) (For RedHat)Linux
Updates for Google Chrome (67.0.3396.79) (For RedHat)Linux
Updates for Google Chrome (67.0.3396.87) (For RedHat)Linux
Google Chrome (67.0.3396.99) (For RedHat)Linux
Updates for Google Chrome (66.0.3359.170) (For Suse)Linux
Updates for Google Chrome (66.0.3359.181) (For Suse)Linux
Updates for Google Chrome (67.0.3396.62) (For Suse)Linux
Updates for Google Chrome (67.0.3396.79) (For Suse)Linux
Updates for Google Chrome (67.0.3396.87) (For Suse)Linux
Google Chrome (67.0.3396.99) (For Suse)Linux
Updates for Google Chrome (66.0.3359.181) (For Ubuntu)Linux
Updates for Google Chrome (67.0.3396.62) (For Ubuntu)Linux
Updates for Google Chrome (67.0.3396.79) (For Ubuntu)Linux
Updates for Google Chrome (67.0.3396.87) (For Ubuntu)Linux
Google Chrome (67.0.3396.99) (For Ubuntu)Linux
SUSE-SU-2023:0586-1(SUSE Linux Enterprise Server 12 SP5 ) monitoring-plugins-nrpe-2.15-6.3.1.x86_64.rpmLinux
SUSE-SU-2023:0586-1(SUSE Linux Enterprise Server 12 SP5 ) monitoring-plugins-nrpe-debuginfo-2.15-6.3.1.x86_64.rpmLinux
SUSE-SU-2023:0586-1(SUSE Linux Enterprise Server 12 SP5 ) nrpe-debugsource-2.15-6.3.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-demo-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-demo-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-devel-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-devel-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-headless-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-headless-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-debuginfo-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-debuginfo-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-debugsource-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-debugsource-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-demo-debuginfo-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-demo-debuginfo-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-devel-debuginfo-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-devel-debuginfo-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP4 ) java-1_8_0-openjdk-headless-debuginfo-1.8.0.392-150000.3.85.1.x86_64.rpmLinux
SUSE-SU-2023:4506-1(Legacy Module 15-SP5 ) java-1_8_0-openjdk-headless-debuginfo-1.8.0.392-150000.3.85.1.x86_64_15_SP5.rpmLinux
SUSE-SU-2023:0586-1(SUSE Linux Enterprise Server 12 SP5 ) nrpe-2.15-6.3.1.x86_64.rpmLinux
SUSE-SU-2023:0586-1(SUSE Linux Enterprise Server 12 SP5 ) nrpe-debuginfo-2.15-6.3.1.x86_64.rpmLinux
CVE-2015-4000NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-301494Update for SeaMonkey (2.35)
PATCH-302079Update for Mozilla Firefox ESR (38.1.0)
PATCH-302105Update for Mozilla Thunderbird (38.1.0)
PATCH-302171Update for Mozilla Firefox ESR (38.1.1)
PATCH-307513Updates for Google Chrome (66.0.3359.170)
PATCH-307515Updates for Google Chrome (x64) (66.0.3359.170)
PATCH-307534Updates for Google Chrome (66.0.3359.181)
PATCH-307535Updates for Google Chrome (x64) (66.0.3359.181)
PATCH-307607Updates for Google Chrome (67.0.3396.62)
PATCH-307608Updates for Google Chrome (x64) (67.0.3396.62)
PATCH-307641Updates for Google Chrome (67.0.3396.79)
PATCH-307644Updates for Google Chrome (x64) (67.0.3396.79)
PATCH-307660Updates for Google Chrome (67.0.3396.87)
PATCH-307662Updates for Google Chrome (x64) (67.0.3396.87)
PATCH-307715Google Chrome (67.0.3396.99)
PATCH-307716Google Chrome (x64) (67.0.3396.99)
PATCH-333702Java SE Development Kit 8 Update 391 (32-bit) (8.0.3910.13) (JDK) (Manual Upload Required)
PATCH-317673Mozilla Firefox (x64) (84.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-613034Apple Safari for MAC (MacOS Sequoia) (26.2)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611088SeaMonkey For Mac (2.53.21)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-611088SeaMonkey For Mac (2.53.21)
PATCH-612783Mozilla Firefox For Mac (145.0.1)
PATCH-612783Mozilla Firefox For Mac (145.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234