{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2015-3197", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2024-08-06T05:39:31.828Z", "dateReserved": "2015-04-10T00:00:00", "datePublished": "2016-02-15T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2022-12-13T00:00:00"}, "descriptions": [{"lang": "en", "value": "ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"}, {"name": "FEDORA-2016-527018d2ff", "tags": ["vendor-advisory"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"name": "openSUSE-SU-2016:0638", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html"}, {"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"}, {"name": "openSUSE-SU-2016:1239", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html"}, {"name": "SUSE-SU-2016:0621", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html"}, {"name": "1034849", "tags": ["vdb-entry"], "url": "http://www.securitytracker.com/id/1034849"}, {"name": "openSUSE-SU-2016:0640", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"}, {"url": "http://www.openssl.org/news/secadv/20160128.txt"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"name": "SUSE-SU-2016:1057", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html"}, {"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893"}, {"name": "GLSA-201601-05", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/201601-05"}, {"name": "openSUSE-SU-2016:1241", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html"}, {"name": "openSUSE-SU-2016:0720", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html"}, {"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us"}, {"name": "SUSE-SU-2016:0624", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html"}, {"name": "SUSE-SU-2016:0631", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"}, {"name": "91787", "tags": ["vdb-entry"], "url": "http://www.securityfocus.com/bid/91787"}, {"name": "SUSE-SU-2016:0617", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html"}, {"name": "VU#257823", "tags": ["third-party-advisory"], "url": "https://www.kb.cert.org/vuls/id/257823"}, {"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"}, {"name": "openSUSE-SU-2016:0628", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"}, {"name": "82237", "tags": ["vdb-entry"], "url": "http://www.securityfocus.com/bid/82237"}, {"name": "SUSE-SU-2016:0678", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html"}, {"name": "SUSE-SU-2016:0620", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html"}, {"name": "openSUSE-SU-2016:0637", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html"}, {"name": "SUSE-SU-2016:0641", "tags": ["vendor-advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html"}, {"url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759"}, {"name": "FreeBSD-SA-16:11", "tags": ["vendor-advisory"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:11.openssl.asc"}, {"url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d81a1600588b726c2bdccda7efad3cc7a87d6245"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}], "datePublic": "2016-01-28T00:00:00"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T05:39:31.828Z"}, "title": "CVE Program Container", "references": [{"url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html", "tags": ["x_transferred"]}, {"name": "FEDORA-2016-527018d2ff", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html", "tags": ["x_transferred"]}, {"name": "openSUSE-SU-2016:0638", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html"}, {"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html", "tags": ["x_transferred"]}, {"name": "openSUSE-SU-2016:1239", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html"}, {"name": "SUSE-SU-2016:0621", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html"}, {"name": "1034849", "tags": ["vdb-entry", "x_transferred"], "url": "http://www.securitytracker.com/id/1034849"}, {"name": "openSUSE-SU-2016:0640", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html", "tags": ["x_transferred"]}, {"url": "http://www.openssl.org/news/secadv/20160128.txt", "tags": ["x_transferred"]}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html", "tags": ["x_transferred"]}, {"name": "SUSE-SU-2016:1057", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html"}, {"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893", "tags": ["x_transferred"]}, {"name": "GLSA-201601-05", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/201601-05"}, {"name": "openSUSE-SU-2016:1241", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html"}, {"name": "openSUSE-SU-2016:0720", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html"}, {"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us", "tags": ["x_transferred"]}, {"name": "SUSE-SU-2016:0624", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html"}, {"name": "SUSE-SU-2016:0631", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html", "tags": ["x_transferred"]}, {"name": "91787", "tags": ["vdb-entry", "x_transferred"], "url": "http://www.securityfocus.com/bid/91787"}, {"name": "SUSE-SU-2016:0617", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html"}, {"name": "VU#257823", "tags": ["third-party-advisory", "x_transferred"], "url": "https://www.kb.cert.org/vuls/id/257823"}, {"url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html", "tags": ["x_transferred"]}, {"name": "openSUSE-SU-2016:0628", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html"}, {"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html", "tags": ["x_transferred"]}, {"name": "82237", "tags": ["vdb-entry", "x_transferred"], "url": "http://www.securityfocus.com/bid/82237"}, {"name": "SUSE-SU-2016:0678", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html"}, {"name": "SUSE-SU-2016:0620", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html"}, {"name": "openSUSE-SU-2016:0637", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html"}, {"name": "SUSE-SU-2016:0641", "tags": ["vendor-advisory", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html"}, {"url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759", "tags": ["x_transferred"]}, {"name": "FreeBSD-SA-16:11", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:11.openssl.asc"}, {"url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d81a1600588b726c2bdccda7efad3cc7a87d6245", "tags": ["x_transferred"]}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:tuxedo:12.1.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "ED0F7609-6AF0-4EEB-8531-8E66C6D18A64", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:exalogic_infrastructure:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "CB059A52-DE6D-47FB-98E8-5A788E1C0FC0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:exalogic_infrastructure:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "D70580AD-2134-49D3-BE15-020023A10E87", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.53:*:*:*:*:*:*:*", "matchCriteriaId": "7F56F01F-9580-4858-A98F-63AD48491328", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.54:*:*:*:*:*:*:*", "matchCriteriaId": "CDD82442-3535-4BB9-8888-F61A35B900AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*", "matchCriteriaId": "45CB30A1-B2C9-4BF5-B510-1F2F18B60C64", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "2D1C00C0-C77E-4255-9ECA-20F2673C7366", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*", "matchCriteriaId": "21F16D65-8A46-4AC7-8970-73AB700035FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*", "matchCriteriaId": "92F393FF-7E6F-4671-BFBF-060162E12659", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*", "matchCriteriaId": "E1B85A09-CF8D-409D-966E-168F9959F6F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*", "matchCriteriaId": "3A66E6CF-39CF-412E-8EF0-8E10BA21B4A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*", "matchCriteriaId": "C684FB18-FDDC-4BED-A28C-C23EE6CD0094", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*", "matchCriteriaId": "A74A79A7-4FAF-4C81-8622-050008B96AE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*", "matchCriteriaId": "CEDACCB9-8D61-49EE-9957-9E58BC7BB031", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*", "matchCriteriaId": "4993DD56-F9E3-4AC8-AC3E-BF204B950DEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*", "matchCriteriaId": "E884B241-F9C3-44F8-A420-DE65F5F3D660", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*", "matchCriteriaId": "3A383620-B4F7-44A7-85DA-A4FF2E115D80", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*", "matchCriteriaId": "5F0C6812-F455-49CF-B29B-9AC00306DA43", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*", "matchCriteriaId": "3F2D462C-A1B4-4572-A615-BDE9DC5F1E55", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*", "matchCriteriaId": "3703E445-17C0-4C85-A496-A35641C0C8DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*", "matchCriteriaId": "2F4034B9-EF1C-40E6-B92A-D4D7B7E7E774", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*", "matchCriteriaId": "ABEC1927-F469-4B9E-B544-DA6CF90F0B34", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:*", "matchCriteriaId": "DE2188F9-FAF8-4A0C-BB49-E95BDBC119BF", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:*", "matchCriteriaId": "A9EC827B-5313-47D7-BF49-CFF033CF3D53", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:*", "matchCriteriaId": "A438E65F-33B1-46BC-AD93-200DCC6B43D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:*", "matchCriteriaId": "4BFDCF78-62C1-429E-A43C-0C9FEC14837D", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:*", "matchCriteriaId": "6A0B4DEF-C6E8-4243-9893-6E650013600C", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "AD3E5C1B-EC63-4214-A0BD-0B8681CE6C8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*", "matchCriteriaId": "18797BEE-417D-4959-9AAD-C5A7C051B524", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*", "matchCriteriaId": "6FAA3C31-BD9D-45A9-A502-837FECA6D479", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*", "matchCriteriaId": "6455A421-9956-4846-AC7C-3431E0D37D23", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*", "matchCriteriaId": "60F946FD-F564-49DA-B043-5943308BA9EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*", "matchCriteriaId": "4847BCF3-EFCE-41AF-8E7D-3D51EB9DCC5B", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*", "matchCriteriaId": "9B89180B-FB68-4DD8-B076-16E51CC7FB91", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*", "matchCriteriaId": "4C986592-4086-4A39-9767-EF34DBAA6A53", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*", "matchCriteriaId": "7B23181C-03DB-4E92-B3F6-6B585B5231B4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:oss_support_tools:8.11.16.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "125C0E9C-3052-461E-8903-A60568AC0634", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:vm_virtualbox:5.0.16:*:*:*:*:*:*:*", "matchCriteriaId": "EF12AB67-8C57-4BF7-AD3B-58B50A5B2023", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions."}, {"lang": "es", "value": "ssl/s2_srvr.c en OpenSSL 1.0.1 en versiones anteriores a 1.0.1r y 1.0.2 en versiones anteriores a 1.0.2f no impide el uso de cifrados deshabilitados, lo que hace que sea m\u00e1s f\u00e1cil para atacantes man-in-the-middle vencer los mecanismos de protecci\u00f3n criptogr\u00e1fica llevando a cabo c\u00e1lculos sobre tr\u00e1fico SSLv2, relacionado con las funciones get_client_master_key y get_client_hello."}], "id": "CVE-2015-3197", "lastModified": "2023-11-07T02:25:31.933", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-02-15T02:59:01.980", "references": [{"source": "secalert@redhat.com", "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759"}, {"source": "secalert@redhat.com", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00017.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00025.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00038.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://www.openssl.org/news/secadv/20160128.txt"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/82237"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/91787"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id/1034849"}, {"source": "secalert@redhat.com", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"}, {"source": "secalert@redhat.com", "url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d81a1600588b726c2bdccda7efad3cc7a87d6245"}, {"source": "secalert@redhat.com", "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us"}, {"source": "secalert@redhat.com", "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893"}, {"source": "secalert@redhat.com", "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:11.openssl.asc"}, {"source": "secalert@redhat.com", "url": "https://security.gentoo.org/glsa/201601-05"}, {"source": "secalert@redhat.com", "url": "https://www.kb.cert.org/vuls/id/257823"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Nimrod Aviram and Sebastian Schinzel as the original reporters.", "affected_release": [{"advisory": "RHSA-2016:0306", "cpe": "cpe:/o:redhat:rhel_els:4", "package": "openssl-0:0.9.7a-43.23.el4", "product_name": "Red Hat Enterprise Linux 4 Extended Lifecycle Support", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0302", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "openssl-0:0.9.8e-39.el5_11", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0304", "cpe": "cpe:/o:redhat:rhel_mission_critical:5.6", "package": "openssl-0:0.9.8e-12.el5_6.13", "product_name": "Red Hat Enterprise Linux 5.6 Long Life", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0304", "cpe": "cpe:/o:redhat:rhel_aus:5.9", "package": "openssl-0:0.9.8e-26.el5_9.5", "product_name": "Red Hat Enterprise Linux 5.9 Long Life", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0301", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "openssl-0:1.0.1e-42.el6_7.4", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0372", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "openssl098e-0:0.9.8e-20.el6_7.1", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2016-03-09T00:00:00Z"}, {"advisory": "RHSA-2016:0303", "cpe": "cpe:/o:redhat:rhel_mission_critical:6.2", "package": "openssl-0:1.0.0-20.el6_2.8", "product_name": "Red Hat Enterprise Linux 6.2 Advanced Update Support", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0303", "cpe": "cpe:/o:redhat:rhel_aus:6.4", "package": "openssl-0:1.0.0-27.el6_4.5", "product_name": "Red Hat Enterprise Linux 6.4 Advanced Update Support", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0303", "cpe": "cpe:/o:redhat:rhel_aus:6.5", "package": "openssl-0:1.0.1e-16.el6_5.16", "product_name": "Red Hat Enterprise Linux 6.5 Advanced Update Support", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0305", "cpe": "cpe:/o:redhat:rhel_eus:6.6", "package": "openssl-0:1.0.1e-30.el6_6.12", "product_name": "Red Hat Enterprise Linux 6.6 Extended Update Support", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0301", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "openssl-1:1.0.1e-51.el7_2.4", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0372", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "openssl098e-0:0.9.8e-29.el7_2.3", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2016-03-09T00:00:00Z"}, {"advisory": "RHSA-2016:0305", "cpe": "cpe:/o:redhat:rhel_eus:7.1", "package": "openssl-1:1.0.1e-42.el7_1.10", "product_name": "Red Hat Enterprise Linux 7.1 Extended Update Support", "release_date": "2016-03-01T00:00:00Z"}, {"advisory": "RHSA-2016:0490", "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6.4", "package": "openssl", "product_name": "Red Hat JBoss Enterprise Application Platform 6.4", "release_date": "2016-03-22T00:00:00Z"}, {"advisory": "RHSA-2016:0445", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:2.1", "package": "openssl", "product_name": "Red Hat JBoss Web Server 2.1", "release_date": "2016-03-14T00:00:00Z"}, {"advisory": "RHSA-2016:0446", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0", "product_name": "Red Hat JBoss Web Server 3.0", "release_date": "2016-03-14T00:00:00Z"}, {"advisory": "RHSA-2016:0379", "cpe": "cpe:/o:redhat:enterprise_linux:6::hypervisor", "package": "rhev-hypervisor7-0:7.2-20160302.1.el6ev", "product_name": "RHEV 3.X Hypervisor and Agents for RHEL-6", "release_date": "2016-03-09T00:00:00Z"}, {"advisory": "RHSA-2016:0379", "cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor", "package": "rhev-hypervisor7-0:7.2-20160302.1.el7ev", "product_name": "RHEV 3.X Hypervisor and Agents for RHEL-7", "release_date": "2016-03-09T00:00:00Z"}], "bugzilla": {"description": "OpenSSL: SSLv2 doesn't block disabled ciphers", "id": "1301846", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1301846"}, "csaw": false, "cvss": {"cvss_base_score": "5.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "status": "verified"}, "details": ["ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.", "A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks."], "name": "CVE-2015-3197", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Affected", "package_name": "openssl097a", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:rhel_eus:6.7", "fix_state": "Affected", "package_name": "guest-images", "product_name": "Red Hat Enterprise Linux Extended Update Support 6.7"}, {"cpe": "cpe:/o:redhat:rhel_eus:7.2", "fix_state": "Affected", "package_name": "rhel-guest-image", "product_name": "Red Hat Enterprise Linux Extended Update Support 7.2"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:5", "fix_state": "Will not fix", "package_name": "openssl", "product_name": "Red Hat JBoss Enterprise Application Platform 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Will not fix", "package_name": "openssl", "product_name": "Red Hat JBoss Enterprise Web Server 1"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3", "fix_state": "Affected", "package_name": "openssl", "product_name": "Red Hat JBoss Enterprise Web Server 3"}], "public_date": "2016-01-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2015-3197\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-3197\nhttps://www.openssl.org/news/secadv/20160128.txt"], "statement": "This security flaw can only be exploited when a malicious client negotiates SSLv2 ciphers and completes a SSLv2 handshake. This flaw cannot be actively exploited by a Man-In-The-Middle attacker. \nAll versions of OpenSSL shipped with Red Hat Enterprise Linux enable SSLv2 protocol, but disable SSLv2 ciphers by default (in Red Hat Enterprise Linux 6 and later), therefore are vulnerable to this flaw. Red Hat Product Security has rated this issue as having Low security impact, a future update may address this flaw.\nSSLv2 suffers from a number of security flaws allowing attackers to capture and alter information passed between a client and the server. Therefore we strongly recommend that SSLv2 should be disabled on all the SSL/TLS servers.", "threat_severity": "Low", "upstream_fix": "openssl 1.0.1r, openssl 1.0.2f"}