Description
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.
No analysis available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2141-1 | New openssl packages fix protocol design flaw |
EUVD |
EUVD-2010-4155 | OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. |
Ubuntu USN |
USN-1029-1 | OpenSSL vulnerabilities |
References
History
Wed, 16 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Subscriptions
Canonical
Subscribe
Ubuntu Linux
Subscribe
Debian
Subscribe
Debian Linux
Subscribe
F5
Subscribe
Nginx
Subscribe
Fedoraproject
Subscribe
Fedora
Subscribe
Openssl
Subscribe
Openssl
Subscribe
Opensuse
Subscribe
Opensuse
Subscribe
Redhat
Subscribe
Enterprise Linux
Subscribe
Jboss Enterprise Web Server
Subscribe
Suse
Subscribe
Linux Enterprise
Subscribe
Linux Enterprise Desktop
Subscribe
Linux Enterprise Server
Subscribe
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-07T03:34:37.524Z
Reserved: 2010-11-04T00:00:00.000Z
Link: CVE-2010-4180
No data.
Status : Deferred
Published: 2010-12-06T21:05:48.687
Modified: 2025-04-11T00:51:21.963
Link: CVE-2010-4180
OpenCVE Enrichment
No data.
Weaknesses
Debian DSA
EUVD
Ubuntu USN