4.3

CVE-2011-3389: canonical ubuntu_linux Inadequate Encryption Strength

Modified
AliasesDEBIAN-CVE-2011-3389CGA-4cqr-5qrm-5phgCGA-84gf-4p6j-vwc2
Published 06-09-2011Last modified 09-10-2026

Vulnerability summary

CVE-2011-3389 is a medium (CVSS 4.3) Inadequate Encryption Strength vulnerability in canonical ubuntu_linux. EPSS estimates a 73.33% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 14-10-2014)

Source freshness unavailable

How is this decided?
CVSS score
4.3/10
010
Medium · v2.0 (NVD)
EPSS score
73.33%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1metasploit

Advisory lineage

Upstream 0 · Downstream 29 · Duplicates 1 · Related 22
DLA-154-1DLA-400-1DSA-2356-1DSA-2358-1DSA-2368-1DSA-2398-1

Timeline

  1. 06-09-2011
    PublishedVulnerability first disclosed.
  2. 09-10-2026
    Last modifiedVulnerability information updated.

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

73.33%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 73.33% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • MetasploitMetasploitremoteUnverified

    SSL/TLS Version Detection

    auxiliary/scanner/ssl/ssl_version

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Chainguard18 products
  • chromiumAll versions (No fix recorded)
  • firefoxAll versions (No fix recorded)
  • openjdk-11-openj9-default-policy< 0.53.0-r0
  • openjdk-17-openj9-default-policy< 0.53.0-r0
  • openjdk-21-openj9-default-policy< 0.53.0-r0
Debian10 products
  • asterisk< 1:13.7.2~dfsg-1
  • bouncycastle< 1.49+dfsg-1
  • curl< 7.24.0-1
  • erlang< 1:15.b-dfsg-1
  • gnutls28All versions (No fix recorded)
Redhat5 products
Microsoft2 products
Siemens2 products
Wolfi2 products
  • chromiumAll versions (No fix recorded)
  • firefoxAll versions (No fix recorded)
Canonical1 product
Google1 product
Haxx1 product
  • curl≥ 7.10.6, ≤ 7.23.1
Mozilla1 product
Opera1 product

11 vendors · 44 products

References

90 links
Show all 90 references