Description
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Metrics
CVSS 3.1 3.7/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.ascThird Party Advisory
- http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgeryThird Party Advisory
- http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.ascMailing List, Third Party Advisory
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402Third Party Advisory
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727Third Party Advisory
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.htmlMailing List, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-07/msg00016.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00094.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00097.htmlMailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143506486712441&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143557934009303&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143558092609708&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143628304012255&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143637549705650&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143655800220052&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143880121627664&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144043644216842&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144050121701297&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144060576831314&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144060606031437&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144061542602287&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144069189622016&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144102017024820&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144104533800819&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144493176821532&w=2Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=145409266329539&w=2Mailing List, Third Party Advisory
- http://openwall.com/lists/oss-security/2015/05/20/8Mailing List, Third Party Advisory
Timeline
- Published
- May 21, 2015
- Last modified
- Jun 17, 2026
- NVD status
- Modified