Back to CVE records
Medium 4.3Published Jan 9, 2015
CVE-2015-0204The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and fa…
Updated under an hour ago ()
Does this affect you?
It affects openssl. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.
- CVSS
- 4.3 MEDIUM (v2.0, NVD)AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Modified
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
openssl openssl openssl:openssl | through 0.9.8zc; 1.0.0a; 1.0.0b; 1.0.0c; 1.0.0d; 1.0.0e; 1.0.0f; 1.0.0g; and 18 more ranges | NVD |
References
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.htmlvendor-advisory, x-refsource-suse
- https://kc.mcafee.com/corporate/index?page=content&id=SB10110x-refsource-confirm
- http://marc.info/?l=bugtraq&m=142895206924048&w=2vendor-advisory, x-refsource-hp
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlx-refsource-confirm
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.htmlvendor-advisory, x-refsource-suse
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150310-sslvendor-advisory, x-refsource-cisco
- http://marc.info/?l=bugtraq&m=142720981827617&w=2vendor-advisory, x-refsource-hp
- http://www.securityfocus.com/bid/71936vdb-entry, x-refsource-bid
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.htmlvendor-advisory, x-refsource-suse
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlx-refsource-confirm
- http://marc.info/?l=bugtraq&m=144050155601375&w=2vendor-advisory, x-refsource-hp
- https://support.apple.com/HT204659x-refsource-confirm
- https://www.openssl.org/news/secadv_20150319.txtx-refsource-confirm
- http://www-304.ibm.com/support/docview.wss?uid=swg21960769x-refsource-confirm
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlx-refsource-confirm
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlx-refsource-confirm
- http://marc.info/?l=bugtraq&m=143748090628601&w=2vendor-advisory, x-refsource-hp
- http://marc.info/?l=bugtraq&m=144043644216842&w=2vendor-advisory, x-refsource-hp
- http://rhn.redhat.com/errata/RHSA-2015-0849.htmlvendor-advisory, x-refsource-redhat
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlx-refsource-confirm
- http://www.securitytracker.com/id/1033378vdb-entry, x-refsource-sectrack
- http://marc.info/?l=bugtraq&m=142721102728110&w=2vendor-advisory, x-refsource-hp
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlvendor-advisory, x-refsource-suse
- https://www.openssl.org/news/secadv_20150108.txtx-refsource-confirm
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:019vendor-advisory, x-refsource-mandriva
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html
- http://marc.info/?l=bugtraq&m=142496179803395&w=2
- http://marc.info/?l=bugtraq&m=142496289803847&w=2
- http://marc.info/?l=bugtraq&m=143213830203296&w=2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.