CVE-2011-5095: Medium severity openssl vulnerability

Published Jun 20, 2012

Updated

The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-1923.

Affected Software

1 affected component

OpenSSL OpenSSL=0.9.8

Event History

Jun 20, 2012

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-5095?

CVE-2011-5095 is classified as a medium severity vulnerability.

How do I fix CVE-2011-5095?

To fix CVE-2011-5095, upgrade to a version of OpenSSL later than 0.9.8 that does not have this vulnerability.

What impact does CVE-2011-5095 have on my system?

CVE-2011-5095 allows man-in-the-middle attackers to obtain the shared secret key, compromising secure communications.

Is CVE-2011-5095 related to any other vulnerabilities?

Yes, CVE-2011-5095 is related to CVE-2011-1923, which also concerns the Diffie-Hellman key-exchange implementation.

What versions of OpenSSL are affected by CVE-2011-5095?

CVE-2011-5095 affects OpenSSL version 0.9.8, specifically when FIPS mode is enabled.