Описание
The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | released | 0.9.8a-7ubuntu0.3 |
| devel | released | 0.9.8b-2ubuntu2 |
| edgy | released | 0.9.8b-2ubuntu2 |
| feisty | released | 0.9.8b-2ubuntu2 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | released | 0.9.7g-5ubuntu1.1 |
| devel | released | 0.9.7k-3 |
| edgy | released | 0.9.7k-3 |
| feisty | released | 0.9.7k-3 |
| upstream | needs-triage |
Показывать по
EPSS
5 Medium
CVSS2
Связанные уязвимости
The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0 ...
The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
Уязвимости системы автоматизации деятельности предприятия 1С:Предприятие, позволяющие злоумышленнику вызвать отказ в обслуживании или получить доступ к зашифрованным данным без знания ключа шифрования
EPSS
5 Medium
CVSS2