Unscored severity · published Dec 6, 2010
CVE-2010-4180
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session…
–
CVSS
9.5%
EPSS
No
On KEV
Description
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
5.0 · source: NVD
FE
Fedora · Fedoraproject
13; 14 · source: NVD
LE
Linux Enterprise · Suse
11.0 · source: NVD
LE
Linux Enterprise Desktop · Suse
10; 10; 11 · source: NVD
LE
Linux Enterprise Server · Suse
9; 10; 10 · source: NVD
NG
Nginx · F5
before 0.9.2 · source: NVD
OP
Openssl · Openssl
before 0.9.8q; 1.0.0 before 1.0.0c · source: NVD
OP
Opensuse · Opensuse
11.1; 11.2; 11.3; 11.4 · source: NVD
UL
Ubuntu Linux · Canonical
6.06; 8.04; 9.04; 10.04; 10.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4180
Broken Link
http://cvs.openssl.org/chngview?cn=20131
Broken Link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777
Broken Link
http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation