Action not permitted
Modal body text goes here.
rhsa-2016_1624
Vulnerability from csaf_redhat
Published
2016-08-17 18:01
Modified
2024-11-22 10:10
Summary
Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 Service Pack 1 security update
Notes
Topic
Updated packages that provide Red Hat JBoss Web Server 3.0.3 Service Pack 1 and fixes two security issues and a bug with ajp processors are now available for Solaris, and Microsoft Windows from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Red Hat JBoss Web Server 3.0.3 Service Pack 1 serves as a update for Red Hat JBoss Web Server 3.0.3 httpd and tomcat.
Security Fix(es):
* It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5387)
* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)
Note: After this update, httpd will no longer pass the value of the Proxy request header to scripts via the HTTP_PROXY environment variable.
Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated packages that provide Red Hat JBoss Web Server 3.0.3 Service Pack 1 and fixes two security issues and a bug with ajp processors are now available for Solaris, and Microsoft Windows from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release of Red Hat JBoss Web Server 3.0.3 Service Pack 1 serves as a update for Red Hat JBoss Web Server 3.0.3 httpd and tomcat.\n\nSecurity Fix(es):\n\n* It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5387)\n\n* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)\n\nNote: After this update, httpd will no longer pass the value of the Proxy request header to scripts via the HTTP_PROXY environment variable.\n\nRed Hat would like to thank Scott Geary (VendHQ) for reporting this issue.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2016:1624", "url": "https://access.redhat.com/errata/RHSA-2016:1624" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=3.0.3", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver\u0026downloadType=securityPatches\u0026version=3.0.3" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html", "url": "https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html" }, { "category": "external", "summary": "https://access.redhat.com/security/vulnerabilities/httpoxy", "url": "https://access.redhat.com/security/vulnerabilities/httpoxy" }, { "category": "external", "summary": "https://access.redhat.com/solutions/2435491", "url": "https://access.redhat.com/solutions/2435491" }, { "category": "external", "summary": "1353755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353755" }, { "category": "external", "summary": "1353809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353809" }, { "category": "external", "summary": "JWS-483", "url": "https://issues.redhat.com/browse/JWS-483" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1624.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.3 Service Pack 1 security update", "tracking": { "current_release_date": "2024-11-22T10:10:52+00:00", "generator": { "date": "2024-11-22T10:10:52+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2016:1624", "initial_release_date": "2016-08-17T18:01:11+00:00", "revision_history": [ { "date": "2016-08-17T18:01:11+00:00", "number": "1", "summary": "Initial version" }, { "date": "2016-08-17T18:01:11+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T10:10:52+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 3.0", "product": { "name": "Red Hat JBoss Web Server 3.0", "product_id": "Red Hat JBoss Web Server 3.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-4000", "cwe": { "id": "CWE-327", "name": "Use of a Broken or Risky Cryptographic Algorithm" }, "discovery_date": "2015-05-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1223211" } ], "notes": [ { "category": "description", "text": "A flaw was found in the way the TLS protocol composes the Diffie-Hellman exchange (for both export and non-export grade cipher suites). An attacker could use this flaw to downgrade a DHE connection to use export-grade key sizes, which could then be broken by sufficient pre-computation. This can lead to a passive man-in-the-middle attack in which the attacker is able to decrypt all traffic.", "title": "Vulnerability description" }, { "category": "summary", "text": "LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the version of openssl and nss libraries as shipped with Red Hat Enterprise Linux 4, 5, 6 and 7. More information about this flaw is available at: https://bugzilla.redhat.com/show_bug.cgi?id=1223211#c4 and https://bugzilla.redhat.com/show_bug.cgi?id=1223211#c5.\n\nRed Hat Enterprise Linux 4 is in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 4.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 3.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-4000" }, { "category": "external", "summary": "RHBZ#1223211", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1223211" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-4000", "url": "https://www.cve.org/CVERecord?id=CVE-2015-4000" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-4000", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4000" }, { "category": "external", "summary": "https://access.redhat.com/articles/1456263", "url": "https://access.redhat.com/articles/1456263" }, { "category": "external", "summary": "https://weakdh.org/", "url": "https://weakdh.org/" } ], "release_date": "2015-05-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-08-17T18:01:11+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.\n\nAfter installing the updated packages, follow the instructions in this\nknowledgebase article to configure Tomcat:\n\nhttps://access.redhat.com/solutions/2435491", "product_ids": [ "Red Hat JBoss Web Server 3.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:1624" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Web Server 3.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks" }, { "acknowledgments": [ { "names": [ "Scott Geary" ], "organization": "VendHQ" } ], "cve": "CVE-2016-5387", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2016-07-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1353755" } ], "notes": [ { "category": "description", "text": "It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTPD: sets environmental variable based on user supplied Proxy request header", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 3.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-5387" }, { "category": "external", "summary": "RHBZ#1353755", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353755" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-5387", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5387" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5387", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5387" }, { "category": "external", "summary": "https://access.redhat.com/security/vulnerabilities/httpoxy", "url": "https://access.redhat.com/security/vulnerabilities/httpoxy" }, { "category": "external", "summary": "https://httpoxy.org/", "url": "https://httpoxy.org/" }, { "category": "external", "summary": "https://www.apache.org/security/asf-httpoxy-response.txt", "url": "https://www.apache.org/security/asf-httpoxy-response.txt" } ], "release_date": "2016-07-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-08-17T18:01:11+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.\n\nAfter installing the updated packages, follow the instructions in this\nknowledgebase article to configure Tomcat:\n\nhttps://access.redhat.com/solutions/2435491", "product_ids": [ "Red Hat JBoss Web Server 3.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:1624" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Web Server 3.0" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTPD: sets environmental variable based on user supplied Proxy request header" }, { "acknowledgments": [ { "names": [ "Scott Geary" ], "organization": "VendHQ" } ], "cve": "CVE-2016-5388", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2016-07-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1353809" } ], "notes": [ { "category": "description", "text": "It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request.", "title": "Vulnerability description" }, { "category": "summary", "text": "Tomcat: CGI sets environmental variable based on user supplied Proxy request header", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Web Server 3.0" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-5388" }, { "category": "external", "summary": "RHBZ#1353809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1353809" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-5388", "url": "https://www.cve.org/CVERecord?id=CVE-2016-5388" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5388", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5388" } ], "release_date": "2016-07-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-08-17T18:01:11+00:00", "details": "The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.\n\nAfter installing the updated packages, follow the instructions in this\nknowledgebase article to configure Tomcat:\n\nhttps://access.redhat.com/solutions/2435491", "product_ids": [ "Red Hat JBoss Web Server 3.0" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:1624" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Web Server 3.0" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Tomcat: CGI sets environmental variable based on user supplied Proxy request header" } ] }
cve-2016-5388
Vulnerability from cvelistv5
Published
2016-07-19 01:00
Modified
2024-08-06 01:00
Severity ?
EPSS score ?
Summary
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T01:00:59.990Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2016:1635", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1635" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759" }, { "name": "VU#797896", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "http://www.kb.cert.org/vuls/id/797896" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html" }, { "name": "RHSA-2016:2045", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html" }, { "name": "RHSA-2016:2046", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://tomcat.apache.org/tomcat-7.0-doc/changelog.html" }, { "name": "91818", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/91818" }, { "name": "openSUSE-SU-2016:2252", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us" }, { "name": "RHSA-2016:1624", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1624.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.apache.org/security/asf-httpoxy-response.txt" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://httpoxy.org/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html" }, { "name": "1036331", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1036331" }, { "name": "RHSA-2016:1636", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1636" }, { "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html" }, { "name": "[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E" }, { "name": "[activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries.", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E" }, { "name": "[activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E" }, { "name": "[tomcat-users] 20200813 CVE reporting discrepencies", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E" }, { "name": "[tomcat-users] 20200813 Re: CVE reporting discrepencies", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E" }, { "name": "[tomcat-users] 20200814 Re: CVE reporting discrepencies", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-07-18T00:00:00", "descriptions": [ { "lang": "en", "value": "Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388\"; in other words, this is not a CVE ID for a vulnerability." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-08-14T10:06:04", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2016:1635", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1635" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759" }, { "name": "VU#797896", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "http://www.kb.cert.org/vuls/id/797896" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html" }, { "name": "RHSA-2016:2045", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-2045.html" }, { "name": "RHSA-2016:2046", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-2046.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://tomcat.apache.org/tomcat-7.0-doc/changelog.html" }, { "name": "91818", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/91818" }, { "name": "openSUSE-SU-2016:2252", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us" }, { "name": "RHSA-2016:1624", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1624.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.apache.org/security/asf-httpoxy-response.txt" }, { "tags": [ "x_refsource_MISC" ], "url": "https://httpoxy.org/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html" }, { "name": "1036331", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1036331" }, { "name": "RHSA-2016:1636", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1636" }, { "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html" }, { "name": "[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E" }, { "name": "[activemq-issues] 20190826 [jira] [Created] (AMQ-7288) Security Vulnerabilities in ActiveMQ dependent libraries.", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E" }, { "name": "[activemq-issues] 20190925 [jira] [Created] (AMQ-7310) Security Vulnerabilities in Tomcat-websocket-api.jar", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/6b414817c2b0bf351138911c8c922ec5dd577ebc0b9a7f42d705752d%40%3Cissues.activemq.apache.org%3E" }, { "name": "[tomcat-users] 20200813 CVE reporting discrepencies", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rc6b2147532416cc736e68a32678d3947b7053c3085cf43a9874fd102%40%3Cusers.tomcat.apache.org%3E" }, { "name": "[tomcat-users] 20200813 Re: CVE reporting discrepencies", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r2853582063cfd9e7fbae1e029ae004e6a83482ae9b70a698996353dd%40%3Cusers.tomcat.apache.org%3E" }, { "name": "[tomcat-users] 20200814 Re: CVE reporting discrepencies", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rf21b368769ae70de4dee840a3228721ae442f1d51ad8742003aefe39%40%3Cusers.tomcat.apache.org%3E" } ] } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-5388", "datePublished": "2016-07-19T01:00:00", "dateReserved": "2016-06-10T00:00:00", "dateUpdated": "2024-08-06T01:00:59.990Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2016-5387
Vulnerability from cvelistv5
Published
2016-07-19 01:00
Modified
2024-08-06 01:00
Severity ?
EPSS score ?
Summary
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T01:00:59.995Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "1036330", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1036330" }, { "name": "RHSA-2016:1420", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1420" }, { "name": "RHSA-2016:1635", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1635" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.apple.com/HT208221" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149" }, { "name": "91816", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/91816" }, { "name": "RHSA-2016:1851", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1851" }, { "name": "USN-3038-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-3038-1" }, { "name": "VU#797896", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "url": "http://www.kb.cert.org/vuls/id/797896" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html" }, { "name": "openSUSE-SU-2016:1824", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html" }, { "name": "RHSA-2016:1648", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1648.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.tenable.com/security/tns-2017-04" }, { "name": "RHSA-2016:1625", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1625.html" }, { "name": "DSA-3623", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2016/dsa-3623" }, { "name": "RHSA-2016:1649", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1649.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us" }, { "name": "RHSA-2016:1422", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1422" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html" }, { "name": "RHSA-2016:1421", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1421" }, { "name": "FEDORA-2016-a29c65b00f", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/" }, { "name": "RHSA-2016:1650", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1650.html" }, { "name": "RHSA-2016:1624", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1624.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.apache.org/security/asf-httpoxy-response.txt" }, { "name": "FEDORA-2016-df0726ae26", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://httpoxy.org/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html" }, { "name": "GLSA-201701-36", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201701-36" }, { "name": "RHSA-2016:1636", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1636" }, { "name": "FEDORA-2016-9fd9bfab9e", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/" }, { "name": "FEDORA-2016-683d0b257b", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1888194 [10/13] - /httpd/site/trunk/content/security/json/", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073139 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-07-18T00:00:00", "descriptions": [ { "lang": "en", "value": "The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"This mitigation has been assigned the identifier CVE-2016-5387\"; in other words, this is not a CVE ID for a vulnerability." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-06-06T10:11:53", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "1036330", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1036330" }, { "name": "RHSA-2016:1420", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1420" }, { "name": "RHSA-2016:1635", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1635" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.apple.com/HT208221" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149" }, { "name": "91816", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/91816" }, { "name": "RHSA-2016:1851", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1851" }, { "name": "USN-3038-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-3038-1" }, { "name": "VU#797896", "tags": [ "third-party-advisory", "x_refsource_CERT-VN" ], "url": "http://www.kb.cert.org/vuls/id/797896" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html" }, { "name": "openSUSE-SU-2016:1824", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html" }, { "name": "RHSA-2016:1648", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1648.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.tenable.com/security/tns-2017-04" }, { "name": "RHSA-2016:1625", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1625.html" }, { "name": "DSA-3623", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2016/dsa-3623" }, { "name": "RHSA-2016:1649", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1649.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us" }, { "name": "RHSA-2016:1422", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1422" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html" }, { "name": "RHSA-2016:1421", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1421" }, { "name": "FEDORA-2016-a29c65b00f", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/" }, { "name": "RHSA-2016:1650", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1650.html" }, { "name": "RHSA-2016:1624", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1624.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.apache.org/security/asf-httpoxy-response.txt" }, { "name": "FEDORA-2016-df0726ae26", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://httpoxy.org/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html" }, { "name": "GLSA-201701-36", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/201701-36" }, { "name": "RHSA-2016:1636", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1636" }, { "name": "FEDORA-2016-9fd9bfab9e", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/" }, { "name": "FEDORA-2016-683d0b257b", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1888194 [10/13] - /httpd/site/trunk/content/security/json/", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073139 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2016-5387", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"This mitigation has been assigned the identifier CVE-2016-5387\"; in other words, this is not a CVE ID for a vulnerability." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "1036330", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1036330" }, { "name": "RHSA-2016:1420", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:1420" }, { "name": "RHSA-2016:1635", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:1635" }, { "name": "https://support.apple.com/HT208221", "refsource": "CONFIRM", "url": "https://support.apple.com/HT208221" }, { "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149", "refsource": "CONFIRM", "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149" }, { "name": "91816", "refsource": "BID", "url": "http://www.securityfocus.com/bid/91816" }, { "name": "RHSA-2016:1851", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:1851" }, { "name": "USN-3038-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-3038-1" }, { "name": "VU#797896", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/797896" }, { "name": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html" }, { "name": "openSUSE-SU-2016:1824", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2016-07/msg00059.html" }, { "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html" }, { "name": "RHSA-2016:1648", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-1648.html" }, { "name": "https://www.tenable.com/security/tns-2017-04", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2017-04" }, { "name": "RHSA-2016:1625", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-1625.html" }, { "name": "DSA-3623", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3623" }, { "name": "RHSA-2016:1649", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-1649.html" }, { "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722", "refsource": "CONFIRM", "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722" }, { "name": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us", "refsource": "CONFIRM", "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03770en_us" }, { "name": "RHSA-2016:1422", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:1422" }, { "name": "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html" }, { "name": "RHSA-2016:1421", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:1421" }, { "name": "FEDORA-2016-a29c65b00f", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6WCTE7443AYZ4EGELWLVNANA2WJCJIYI/" }, { "name": "RHSA-2016:1650", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-1650.html" }, { "name": "RHSA-2016:1624", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-1624.html" }, { "name": "https://www.apache.org/security/asf-httpoxy-response.txt", "refsource": "CONFIRM", "url": "https://www.apache.org/security/asf-httpoxy-response.txt" }, { "name": "FEDORA-2016-df0726ae26", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TGNHXJJSWDXAOEYH5TMXDPQVJMQQJOAZ/" }, { "name": "https://httpoxy.org/", "refsource": "MISC", "url": "https://httpoxy.org/" }, { "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html" }, { "name": "GLSA-201701-36", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201701-36" }, { "name": "RHSA-2016:1636", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2016:1636" }, { "name": "FEDORA-2016-9fd9bfab9e", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEKZAB7MTWVSMORHTEMCQNFFMIHCYF76/" }, { "name": "FEDORA-2016-683d0b257b", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QPQAPWQA774JPDRV4UIB2SZAX6D3UZCV/" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1888194 [10/13] - /httpd/site/trunk/content/security/json/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073139 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E" }, { "name": "[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E" } ] } } } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-5387", "datePublished": "2016-07-19T01:00:00", "dateReserved": "2016-06-10T00:00:00", "dateUpdated": "2024-08-06T01:00:59.995Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2015-4000
Vulnerability from cvelistv5
Published
2015-05-21 00:00
Modified
2024-08-06 06:04
Severity ?
EPSS score ?
Summary
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T06:04:02.725Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "SUSE-SU-2015:1184", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html" }, { "name": "SUSE-SU-2015:1177", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html" }, { "name": "SSRT102180", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143880121627664\u0026w=2" }, { "name": "RHSA-2015:1243", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1243.html" }, { "name": "openSUSE-SU-2015:1229", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html" }, { "name": "1033208", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033208" }, { "name": "1032637", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032637" }, { "name": "HPSBGN03404", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144050121701297\u0026w=2" }, { "name": "DSA-3688", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.debian.org/security/2016/dsa-3688" }, { "name": "DSA-3287", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.debian.org/security/2015/dsa-3287" }, { "name": "HPSBUX03512", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144493176821532\u0026w=2" }, { "name": "1032865", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032865" }, { "name": "HPSBGN03351", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143557934009303\u0026w=2" }, { "name": "SUSE-SU-2015:1268", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html" }, { "name": "SUSE-SU-2015:1150", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html" }, { "name": "1034728", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1034728" }, { "name": "SUSE-SU-2015:1183", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html" }, { "name": "1032656", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032656" }, { "name": "RHSA-2016:2056", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-2056.html" }, { "name": "[oss-security] 20150520 CVE-2015-4000 - TLS does not properly convey server\u0027s ciphersuite choice", "tags": [ "mailing-list", "x_transferred" ], "url": "http://openwall.com/lists/oss-security/2015/05/20/8" }, { "name": "openSUSE-SU-2015:1684", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html" }, { "name": "HPSBGN03361", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143628304012255\u0026w=2" }, { "name": "HPSBGN03399", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144060576831314\u0026w=2" }, { "name": "1032475", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032475" }, { "name": "1032960", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032960" }, { "name": "openSUSE-SU-2016:0255", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html" }, { "name": "1032653", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032653" }, { "name": "SUSE-SU-2016:0224", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html" }, { "name": "1033385", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033385" }, { "name": "GLSA-201512-10", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201512-10" }, { "name": "RHSA-2015:1229", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1229.html" }, { "name": "openSUSE-SU-2016:0483", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00097.html" }, { "name": "1032864", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032864" }, { "name": "1032910", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032910" }, { "name": "1032645", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032645" }, { "name": "USN-2706-1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-2706-1" }, { "name": "GLSA-201701-46", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201701-46" }, { "name": "RHSA-2015:1526", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1526.html" }, { "name": "1033760", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033760" }, { "name": "RHSA-2015:1485", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1485.html" }, { "name": "RHSA-2015:1197", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1197.html" }, { "name": "HPSBMU03401", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144104533800819\u0026w=2" }, { "name": "1032699", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032699" }, { "name": "1032476", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032476" }, { "name": "1032649", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032649" }, { "name": "HPSBMU03345", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144043644216842\u0026w=2" }, { "name": "HPSBUX03363", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143637549705650\u0026w=2" }, { "name": "RHSA-2015:1544", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1544.html" }, { "name": "FEDORA-2015-9130", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html" }, { "name": "SUSE-SU-2015:1182", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html" }, { "name": "SSRT102112", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04718196" }, { "name": "1032688", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032688" }, { "name": "SUSE-SU-2015:1143", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html" }, { "name": "1032652", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032652" }, { "name": "FEDORA-2015-9048", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html" }, { "name": "RHSA-2015:1185", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1185.html" }, { "name": "HPSBGN03362", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143558092609708\u0026w=2" }, { "name": "APPLE-SA-2015-06-30-2", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html" }, { "name": "openSUSE-SU-2015:1289", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html" }, { "name": "FEDORA-2015-9161", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html" }, { "name": "HPSBGN03402", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144069189622016\u0026w=2" }, { "name": "1032648", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032648" }, { "name": "1032759", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032759" }, { "name": "RHSA-2015:1228", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1228.html" }, { "name": "HPSBGN03405", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144060606031437\u0026w=2" }, { "name": "DSA-3316", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.debian.org/security/2015/dsa-3316" }, { "name": "1033209", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033209" }, { "name": "1032871", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032871" }, { "name": "DSA-3324", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.debian.org/security/2015/dsa-3324" }, { "name": "1032655", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032655" }, { "name": "1033210", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033210" }, { "name": "HPSBGN03411", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144061542602287\u0026w=2" }, { "name": "openSUSE-SU-2015:1277", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html" }, { "name": "HPSBGN03533", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=145409266329539\u0026w=2" }, { "name": "USN-2673-1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-2673-1" }, { "name": "1034884", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1034884" }, { "name": "HPSBMU03356", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143506486712441\u0026w=2" }, { "name": "GLSA-201603-11", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201603-11" }, { "name": "1033064", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033064" }, { "name": "SUSE-SU-2015:1181", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html" }, { "name": "1032778", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032778" }, { "name": "1032474", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032474" }, { "name": "SSRT102254", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144493176821532\u0026w=2" }, { "name": "HPSBGN03407", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=144102017024820\u0026w=2" }, { "name": "openSUSE-SU-2015:1209", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00016.html" }, { "name": "1032784", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032784" }, { "name": "1032777", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032777" }, { "name": "1033416", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033416" }, { "name": "1033991", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033991" }, { "name": "1032647", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032647" }, { "name": "1032654", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032654" }, { "name": "1033341", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033341" }, { "name": "RHSA-2015:1486", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1486.html" }, { "name": "SUSE-SU-2015:1663", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html" }, { "name": "1033433", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033433" }, { "name": "USN-2696-1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-2696-1" }, { "name": "APPLE-SA-2015-06-30-1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html" }, { "name": "1032702", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032702" }, { "name": "DSA-3339", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.debian.org/security/2015/dsa-3339" }, { "name": "1032727", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032727" }, { "name": "RHSA-2015:1242", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1242.html" }, { "name": "SUSE-SU-2015:1269", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html" }, { "name": "GLSA-201506-02", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/201506-02" }, { "name": "91787", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securityfocus.com/bid/91787" }, { "name": "RHSA-2016:1624", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1624.html" }, { "name": "openSUSE-SU-2015:1266", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html" }, { "name": "RHSA-2015:1488", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1488.html" }, { "name": "SUSE-SU-2015:1319", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html" }, { "name": "SUSE-SU-2015:1320", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html" }, { "name": "1033430", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033430" }, { "name": "openSUSE-SU-2015:1288", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html" }, { "name": "RHSA-2015:1241", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1241.html" }, { "name": "openSUSE-SU-2016:0478", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00094.html" }, { "name": "SUSE-SU-2015:1581", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html" }, { "name": "HPSBUX03388", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143880121627664\u0026w=2" }, { "name": "RHSA-2015:1230", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1230.html" }, { "name": "74733", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securityfocus.com/bid/74733" }, { "name": "openSUSE-SU-2016:0261", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html" }, { "name": "1032651", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032651" }, { "name": "1033065", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033065" }, { "name": "USN-2656-1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-2656-1" }, { "name": "SUSE-SU-2015:1185", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html" }, { "name": "1033222", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033222" }, { "name": "1036218", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1036218" }, { "name": "SUSE-SU-2015:1449", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html" }, { "name": "HPSBGN03373", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=143655800220052\u0026w=2" }, { "name": "1040630", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1040630" }, { "name": "openSUSE-SU-2015:1139", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html" }, { "name": "1034087", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1034087" }, { "name": "1033513", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033513" }, { "name": "1032884", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032884" }, { "name": "RHSA-2015:1604", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1604.html" }, { "name": "SUSE-SU-2016:0262", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html" }, { "name": "1032932", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032932" }, { "name": "1033891", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033891" }, { "name": "openSUSE-SU-2016:0226", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html" }, { "name": "1032783", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032783" }, { "name": "1032856", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032856" }, { "name": "NetBSD-SA2015-008", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc" }, { "name": "DSA-3300", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.debian.org/security/2015/dsa-3300" }, { "name": "USN-2656-2", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-2656-2" }, { "name": "1033067", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033067" }, { "name": "1033019", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1033019" }, { "name": "RHSA-2015:1072", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1072.html" }, { "name": "1032650", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securitytracker.com/id/1032650" }, { "tags": [ "x_transferred" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "tags": [ "x_transferred" ], "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10681" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21962739" }, { "tags": [ "x_transferred" ], "url": "https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923929" }, { "tags": [ "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "tags": [ "x_transferred" ], "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10122" }, { "tags": [ "x_transferred" ], "url": "http://support.apple.com/kb/HT204941" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21962816" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959812" }, { "tags": [ "x_transferred" ], "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21959745" }, { "tags": [ "x_transferred" ], "url": "https://weakdh.org/imperfect-forward-secrecy.pdf" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21959132" }, { "tags": [ "x_transferred" ], "url": "https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959539" }, { "tags": [ "x_transferred" ], "url": "https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959325" }, { "tags": [ "x_transferred" ], "url": "https://openssl.org/news/secadv/20150611.txt" }, { "tags": [ "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04740527" }, { "tags": [ "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html" }, { "tags": [ "x_transferred" ], "url": "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778" }, { "tags": [ "x_transferred" ], "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03831en_us" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21967893" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21958984" }, { "tags": [ "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959517" }, { "tags": [ "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959195" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21961717" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960041" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960194" }, { "tags": [ "x_transferred" ], "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959453" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20150619-0001/" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959111" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960418" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246" }, { "tags": [ "x_transferred" ], "url": "https://www.suse.com/security/cve/CVE-2015-4000.html" }, { "tags": [ "x_transferred" ], "url": "https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes" }, { "tags": [ "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04953655" }, { "tags": [ "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128722" }, { "tags": [ "x_transferred" ], "url": "http://support.citrix.com/article/CTX201114" }, { "tags": [ "x_transferred" ], "url": "http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery" }, { "tags": [ "x_transferred" ], "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960380" }, { "tags": [ "x_transferred" ], "url": "http://support.apple.com/kb/HT204942" }, { "tags": [ "x_transferred" ], "url": "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402" }, { "tags": [ "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193083" }, { "tags": [ "x_transferred" ], "url": "http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc" }, { "tags": [ "x_transferred" ], "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10727" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959530" }, { "tags": [ "x_transferred" ], "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21960191" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959636" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04918839" }, { "tags": [ "x_transferred" ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140" }, { "tags": [ "x_transferred" ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763" }, { "tags": [ "x_transferred" ], "url": "https://puppet.com/security/cve/CVE-2015-4000" }, { "tags": [ "x_transferred" ], "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-70.html" }, { "tags": [ "x_transferred" ], "url": "http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/releaseNotes.htm" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789" }, { "tags": [ "x_transferred" ], "url": "https://support.citrix.com/article/CTX216642" }, { "tags": [ "x_transferred" ], "url": "https://weakdh.org/" }, { "tags": [ "x_transferred" ], "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959481" }, { "tags": [ "x_transferred" ], "url": "https://bto.bluecoat.com/security-advisory/sa98" }, { "tags": [ "x_transferred" ], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1138554" }, { "tags": [ "x_transferred" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21962455" }, { "tags": [ "x_transferred" ], "url": "https://www.openssl.org/news/secadv_20150611.txt" }, { "tags": [ "x_transferred" ], "url": "http://www.fortiguard.com/advisory/2015-05-20-logjam-attack" }, { "tags": [ "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2015-05-19T00:00:00", "descriptions": [ { "lang": "en", "value": "The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the \"Logjam\" issue." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-12-13T00:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "SUSE-SU-2015:1184", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html" }, { "name": "SUSE-SU-2015:1177", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html" }, { "name": "SSRT102180", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143880121627664\u0026w=2" }, { "name": "RHSA-2015:1243", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1243.html" }, { "name": "openSUSE-SU-2015:1229", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html" }, { "name": "1033208", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033208" }, { "name": "1032637", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032637" }, { "name": "HPSBGN03404", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144050121701297\u0026w=2" }, { "name": "DSA-3688", "tags": [ "vendor-advisory" ], "url": "http://www.debian.org/security/2016/dsa-3688" }, { "name": "DSA-3287", "tags": [ "vendor-advisory" ], "url": "http://www.debian.org/security/2015/dsa-3287" }, { "name": "HPSBUX03512", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144493176821532\u0026w=2" }, { "name": "1032865", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032865" }, { "name": "HPSBGN03351", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143557934009303\u0026w=2" }, { "name": "SUSE-SU-2015:1268", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html" }, { "name": "SUSE-SU-2015:1150", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html" }, { "name": "1034728", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1034728" }, { "name": "SUSE-SU-2015:1183", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html" }, { "name": "1032656", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032656" }, { "name": "RHSA-2016:2056", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-2056.html" }, { "name": "[oss-security] 20150520 CVE-2015-4000 - TLS does not properly convey server\u0027s ciphersuite choice", "tags": [ "mailing-list" ], "url": "http://openwall.com/lists/oss-security/2015/05/20/8" }, { "name": "openSUSE-SU-2015:1684", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html" }, { "name": "HPSBGN03361", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143628304012255\u0026w=2" }, { "name": "HPSBGN03399", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144060576831314\u0026w=2" }, { "name": "1032475", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032475" }, { "name": "1032960", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032960" }, { "name": "openSUSE-SU-2016:0255", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html" }, { "name": "1032653", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032653" }, { "name": "SUSE-SU-2016:0224", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html" }, { "name": "1033385", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033385" }, { "name": "GLSA-201512-10", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/201512-10" }, { "name": "RHSA-2015:1229", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1229.html" }, { "name": "openSUSE-SU-2016:0483", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00097.html" }, { "name": "1032864", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032864" }, { "name": "1032910", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032910" }, { "name": "1032645", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032645" }, { "name": "USN-2706-1", "tags": [ "vendor-advisory" ], "url": "http://www.ubuntu.com/usn/USN-2706-1" }, { "name": "GLSA-201701-46", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/201701-46" }, { "name": "RHSA-2015:1526", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1526.html" }, { "name": "1033760", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033760" }, { "name": "RHSA-2015:1485", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1485.html" }, { "name": "RHSA-2015:1197", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1197.html" }, { "name": "HPSBMU03401", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144104533800819\u0026w=2" }, { "name": "1032699", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032699" }, { "name": "1032476", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032476" }, { "name": "1032649", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032649" }, { "name": "HPSBMU03345", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144043644216842\u0026w=2" }, { "name": "HPSBUX03363", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143637549705650\u0026w=2" }, { "name": "RHSA-2015:1544", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1544.html" }, { "name": "FEDORA-2015-9130", "tags": [ "vendor-advisory" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html" }, { "name": "SUSE-SU-2015:1182", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html" }, { "name": "SSRT102112", "tags": [ "vendor-advisory" ], "url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04718196" }, { "name": "1032688", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032688" }, { "name": "SUSE-SU-2015:1143", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html" }, { "name": "1032652", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032652" }, { "name": "FEDORA-2015-9048", "tags": [ "vendor-advisory" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html" }, { "name": "RHSA-2015:1185", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1185.html" }, { "name": "HPSBGN03362", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143558092609708\u0026w=2" }, { "name": "APPLE-SA-2015-06-30-2", "tags": [ "vendor-advisory" ], "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html" }, { "name": "openSUSE-SU-2015:1289", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html" }, { "name": "FEDORA-2015-9161", "tags": [ "vendor-advisory" ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html" }, { "name": "HPSBGN03402", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144069189622016\u0026w=2" }, { "name": "1032648", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032648" }, { "name": "1032759", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032759" }, { "name": "RHSA-2015:1228", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1228.html" }, { "name": "HPSBGN03405", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144060606031437\u0026w=2" }, { "name": "DSA-3316", "tags": [ "vendor-advisory" ], "url": "http://www.debian.org/security/2015/dsa-3316" }, { "name": "1033209", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033209" }, { "name": "1032871", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032871" }, { "name": "DSA-3324", "tags": [ "vendor-advisory" ], "url": "http://www.debian.org/security/2015/dsa-3324" }, { "name": "1032655", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032655" }, { "name": "1033210", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033210" }, { "name": "HPSBGN03411", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144061542602287\u0026w=2" }, { "name": "openSUSE-SU-2015:1277", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html" }, { "name": "HPSBGN03533", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=145409266329539\u0026w=2" }, { "name": "USN-2673-1", "tags": [ "vendor-advisory" ], "url": "http://www.ubuntu.com/usn/USN-2673-1" }, { "name": "1034884", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1034884" }, { "name": "HPSBMU03356", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143506486712441\u0026w=2" }, { "name": "GLSA-201603-11", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/201603-11" }, { "name": "1033064", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033064" }, { "name": "SUSE-SU-2015:1181", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html" }, { "name": "1032778", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032778" }, { "name": "1032474", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032474" }, { "name": "SSRT102254", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144493176821532\u0026w=2" }, { "name": "HPSBGN03407", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=144102017024820\u0026w=2" }, { "name": "openSUSE-SU-2015:1209", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00016.html" }, { "name": "1032784", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032784" }, { "name": "1032777", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032777" }, { "name": "1033416", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033416" }, { "name": "1033991", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033991" }, { "name": "1032647", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032647" }, { "name": "1032654", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032654" }, { "name": "1033341", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033341" }, { "name": "RHSA-2015:1486", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1486.html" }, { "name": "SUSE-SU-2015:1663", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html" }, { "name": "1033433", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033433" }, { "name": "USN-2696-1", "tags": [ "vendor-advisory" ], "url": "http://www.ubuntu.com/usn/USN-2696-1" }, { "name": "APPLE-SA-2015-06-30-1", "tags": [ "vendor-advisory" ], "url": "http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html" }, { "name": "1032702", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032702" }, { "name": "DSA-3339", "tags": [ "vendor-advisory" ], "url": "http://www.debian.org/security/2015/dsa-3339" }, { "name": "1032727", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032727" }, { "name": "RHSA-2015:1242", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1242.html" }, { "name": "SUSE-SU-2015:1269", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html" }, { "name": "GLSA-201506-02", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/201506-02" }, { "name": "91787", "tags": [ "vdb-entry" ], "url": "http://www.securityfocus.com/bid/91787" }, { "name": "RHSA-2016:1624", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2016-1624.html" }, { "name": "openSUSE-SU-2015:1266", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html" }, { "name": "RHSA-2015:1488", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1488.html" }, { "name": "SUSE-SU-2015:1319", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html" }, { "name": "SUSE-SU-2015:1320", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html" }, { "name": "1033430", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033430" }, { "name": "openSUSE-SU-2015:1288", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html" }, { "name": "RHSA-2015:1241", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1241.html" }, { "name": "openSUSE-SU-2016:0478", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00094.html" }, { "name": "SUSE-SU-2015:1581", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html" }, { "name": "HPSBUX03388", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143880121627664\u0026w=2" }, { "name": "RHSA-2015:1230", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1230.html" }, { "name": "74733", "tags": [ "vdb-entry" ], "url": "http://www.securityfocus.com/bid/74733" }, { "name": "openSUSE-SU-2016:0261", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html" }, { "name": "1032651", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032651" }, { "name": "1033065", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033065" }, { "name": "USN-2656-1", "tags": [ "vendor-advisory" ], "url": "http://www.ubuntu.com/usn/USN-2656-1" }, { "name": "SUSE-SU-2015:1185", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html" }, { "name": "1033222", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033222" }, { "name": "1036218", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1036218" }, { "name": "SUSE-SU-2015:1449", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html" }, { "name": "HPSBGN03373", "tags": [ "vendor-advisory" ], "url": "http://marc.info/?l=bugtraq\u0026m=143655800220052\u0026w=2" }, { "name": "1040630", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1040630" }, { "name": "openSUSE-SU-2015:1139", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html" }, { "name": "1034087", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1034087" }, { "name": "1033513", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033513" }, { "name": "1032884", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032884" }, { "name": "RHSA-2015:1604", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1604.html" }, { "name": "SUSE-SU-2016:0262", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html" }, { "name": "1032932", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032932" }, { "name": "1033891", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033891" }, { "name": "openSUSE-SU-2016:0226", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html" }, { "name": "1032783", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032783" }, { "name": "1032856", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032856" }, { "name": "NetBSD-SA2015-008", "tags": [ "vendor-advisory" ], "url": "http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc" }, { "name": "DSA-3300", "tags": [ "vendor-advisory" ], "url": "http://www.debian.org/security/2015/dsa-3300" }, { "name": "USN-2656-2", "tags": [ "vendor-advisory" ], "url": "http://www.ubuntu.com/usn/USN-2656-2" }, { "name": "1033067", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033067" }, { "name": "1033019", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1033019" }, { "name": "RHSA-2015:1072", "tags": [ "vendor-advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1072.html" }, { "name": "1032650", "tags": [ "vdb-entry" ], "url": "http://www.securitytracker.com/id/1032650" }, { "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html" }, { "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10681" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21962739" }, { "url": "https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923929" }, { "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html" }, { "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10122" }, { "url": "http://support.apple.com/kb/HT204941" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21962816" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959812" }, { "url": "https://www-304.ibm.com/support/docview.wss?uid=swg21959745" }, { "url": "https://weakdh.org/imperfect-forward-secrecy.pdf" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21959132" }, { "url": "https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959539" }, { "url": "https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959325" }, { "url": "https://openssl.org/news/secadv/20150611.txt" }, { "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04740527" }, { "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html" }, { "url": "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778" }, { "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03831en_us" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21967893" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21958984" }, { "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959517" }, { "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959195" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21961717" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960041" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960194" }, { "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959453" }, { "url": "https://security.netapp.com/advisory/ntap-20150619-0001/" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959111" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960418" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246" }, { "url": "https://www.suse.com/security/cve/CVE-2015-4000.html" }, { "url": "https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes" }, { "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04953655" }, { "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128722" }, { "url": "http://support.citrix.com/article/CTX201114" }, { "url": "http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery" }, { "url": "http://www-304.ibm.com/support/docview.wss?uid=swg21960380" }, { "url": "http://support.apple.com/kb/HT204942" }, { "url": "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402" }, { "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193083" }, { "url": "http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc" }, { "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10727" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959530" }, { "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21960191" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959636" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04918839" }, { "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140" }, { "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763" }, { "url": "https://puppet.com/security/cve/CVE-2015-4000" }, { "url": "http://www.mozilla.org/security/announce/2015/mfsa2015-70.html" }, { "url": "http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/releaseNotes.htm" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789" }, { "url": "https://support.citrix.com/article/CTX216642" }, { "url": "https://weakdh.org/" }, { "url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21959481" }, { "url": "https://bto.bluecoat.com/security-advisory/sa98" }, { "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1138554" }, { "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21962455" }, { "url": "https://www.openssl.org/news/secadv_20150611.txt" }, { "url": "http://www.fortiguard.com/advisory/2015-05-20-logjam-attack" }, { "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-4000", "datePublished": "2015-05-21T00:00:00", "dateReserved": "2015-05-15T00:00:00", "dateUpdated": "2024-08-06T06:04:02.725Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.