CVE-2015-4000

Advisory lineage Upstream: 0 Downstream: 76
Modified
Published: 21 May 2015, 00:00
Last modified:27 May 2026, 16:22

Vulnerability Summary

Overall Risk (default)
medium
46/100
CVSS Score
4.3 MEDIUM
v2.0 (nvd)
EPSS Score
92.35% CRITICAL
92% probability -1.55%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

21 May 2015, 00:00
Published
Vulnerability first disclosed
27 May 2026, 16:22
Last Modified
Vulnerability information updated

Description

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

CVSS Metrics

  • v3.1•LOW•Score: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  • v3.0•LOW•Score: 3.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 92.35%• Percentile: 100%

Techniques & Countermeasures

  • CWE-310•Cryptographic Issues

    Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

  • CWE-295•Improper Certificate Validation

    The product does not validate, or incorrectly validates, a certificate.

Affected Systems

  • apple•iphone_os

    ≤ 8.3

  • apple•mac_os_x

    ≤ 10.10.3

  • apple•safari

    na

  • canonical•ubuntu_linux

    12.04 | 14.04 | 14.10 | 15.04

  • debian•debian_linux

    7.0 | 8.0

  • google•chrome

    na

  • hp•hp-ux

    b.11.31

  • ibm•content_manager

    8.5

  • Unknown•Internet Explorer

    na

  • mozilla•firefox

    na | 38.1.0 | 39.0

  • mozilla•firefox_esr

    31.8

  • mozilla•firefox_os

    2.2

  • mozilla•network_security_services

    3.19

  • mozilla•seamonkey

    2.35

  • mozilla•thunderbird

    31.8 | 38.1

  • Unknown•OpenSSL

    ≥ 1.0.1, ≤ 1.0.1m | ≥ 1.0.2, ≤ 1.0.2a | ≤ 1.0.1m

  • opera•opera_browser

    na

  • oracle•jdk

    1.6.0:update95 | 1.7.0:update75 | 1.7.0:update80 | 1.8.0:update_33 | 1.8.0:update45

  • oracle•jre

    1.6.0:update_95 | 1.7.0:update_75 | 1.7.0:update_80 | 1.8.0:update_33 | 1.8.0:update_45

  • oracle•jrockit

    r28.3.6

  • oracle•sparc-opl_service_processor

    ≤ 1121

  • suse•linux_enterprise_desktop

    12

  • suse•linux_enterprise_server

    11.0:sp4

  • suse•linux_enterprise_software_development_kit

    12

  • suse•suse_linux_enterprise_server

    12

References (217)