CVE-2015-0204: Medium severity openssl vulnerability
The ssl3getkeyexchange function in s3clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORTRSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORTRSA issues associated with servers or other TLS implementations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0204?
CVE-2015-0204 is considered a critical vulnerability due to its potential to enable RSA-to-EXPORT_RSA downgrade attacks.
How do I fix CVE-2015-0204?
To fix CVE-2015-0204, upgrade to OpenSSL version 0.9.8zd, 1.0.0p, or 1.0.1k or later.
What is the impact of CVE-2015-0204?
The impact of CVE-2015-0204 includes the risk of brute-force decryption of SSL connections using weak ephemeral RSA keys.
Which OpenSSL versions are affected by CVE-2015-0204?
OpenSSL versions prior to 0.9.8zd, 1.0.0p, and 1.0.1k are affected by CVE-2015-0204.
Can CVE-2015-0204 be exploited remotely?
Yes, CVE-2015-0204 can be exploited remotely by SSL servers conducting downgrade attacks.