CVE-2015-2808

Advisory lineage Upstream: 0 Downstream: 32
Modified
Published: 01 Apr 2015, 00:00
Last modified:28 May 2026, 12:53

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
5 MEDIUM
v2.0 (nvd)
EPSS Score
23.82% HIGH
24% probability -11.49%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Apr 2015, 00:00
Published
Vulnerability first disclosed
28 May 2026, 12:53
Last Modified
Vulnerability information updated

Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

CVSS Metrics

  • v3.1•LOW•Score: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 23.82%• Percentile: 96%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

Affected Systems

  • canonical•ubuntu_linux

    12.04 | 14.04 | 15.04

  • debian•debian_linux

    7.0 | 8.0

  • fujitsu•sparc_enterprise_m3000_firmware

    ≥ xcp, < xcp_1121

  • fujitsu•sparc_enterprise_m4000_firmware

    ≥ xcp, < xcp_1121

  • fujitsu•sparc_enterprise_m5000_firmware

    ≥ xcp, < xcp_1121

  • fujitsu•sparc_enterprise_m8000_firmware

    ≥ xcp, < xcp_1121

  • fujitsu•sparc_enterprise_m9000_firmware

    ≥ xcp, < xcp_1121

  • huawei•9700_firmware

    na

  • huawei•e6000_firmware

    na

  • huawei•e9000_firmware

    na

  • huawei•oceanstor_18500_firmware

    na

  • huawei•oceanstor_18800_firmware

    na

  • huawei•oceanstor_18800f_firmware

    na

  • huawei•oceanstor_9000_firmware

    na

  • huawei•oceanstor_cse_firmware

    na

  • huawei•oceanstor_hvs85t_firmware

    na

  • huawei•oceanstor_replicationdirector

    v100r003c00

  • huawei•oceanstor_s2600t_firmware

    na

  • huawei•oceanstor_s5500t_firmware

    na

  • huawei•oceanstor_s5600t_firmware

    na

  • huawei•oceanstor_s5800t_firmware

    na

  • huawei•oceanstor_s6800t_firmware

    na

  • huawei•oceanstor_vis6600t_firmware

    na

  • huawei•policy_center

    v100r003c00 | v100r003c10

  • huawei•quidway_s9300_firmware

    na

  • huawei•s12700_firmware

    na

  • huawei•s2700_firmware

    na

  • huawei•s2750_firmware

    na

  • huawei•s3700_firmware

    na

  • huawei•s5700ei_firmware

    na

  • huawei•s5700hi_firmware

    na

  • huawei•s5700li_firmware

    na

  • huawei•s5700s-li_firmware

    na

  • huawei•s5700si_firmware

    na

  • huawei•s5710ei_firmware

    na

  • huawei•s5710hi_firmware

    na

  • huawei•s5720ei_firmware

    na

  • huawei•s5720hi_firmware

    na

  • huawei•s6700_firmware

    na

  • huawei•s7700_firmware

    na

  • huawei•smc2.0

    v100r002c01 | v100r002c02 | v100r002c03 | v100r002c04

  • huawei•te60_firmware

    na

  • huawei•ultravr

    v100r003c00

  • ibm•cognos_metrics_manager

    10.1 | 10.1.1 | 10.2 | 10.2.1 | 10.2.2

  • opensuse•opensuse

    13.1 | 13.2

  • oracle•communications_application_session_controller

    ≥ 3.0.0, ≤ 3.9.0

  • oracle•communications_policy_management

    < 9.9.2

  • oracle•http_server

    11.1.1.7.0 | 11.1.1.9.0 | 12.1.3.0.0 | 12.2.1.1.0 | 12.2.1.2.0

  • oracle•integrated_lights_out_manager_firmware

    ≥ 3.0.0, ≤ 3.2.11 | ≥ 4.0.0, ≤ 4.0.4

  • redhat•enterprise_linux_desktop

    5.0 | 6.0 | 7.0

Showing first 50 affected entries in server-rendered view.

References (101)