CVE-2015-7575
First published: Wed Dec 09 2015(Updated: )
A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.7.0-oracle-1:1.7.0.95-1jpp.1.el5_11 | 1.7.0-oracle-1:1.7.0.95-1jpp.1.el5_11 |
| redhat/java | <1.8.0-oracle-1:1.8.0.71-1jpp.1.el6_7 | 1.8.0-oracle-1:1.8.0.71-1jpp.1.el6_7 |
| redhat/java | <1.7.0-oracle-1:1.7.0.95-1jpp.1.el6_7 | 1.7.0-oracle-1:1.7.0.95-1jpp.1.el6_7 |
| redhat/java | <1.8.0-oracle-1:1.8.0.71-1jpp.1.el7 | 1.8.0-oracle-1:1.8.0.71-1jpp.1.el7 |
| redhat/java | <1.7.0-oracle-1:1.7.0.95-1jpp.2.el7 | 1.7.0-oracle-1:1.7.0.95-1jpp.2.el7 |
| redhat/java | <1.7.0-openjdk-1:1.7.0.95-2.6.4.1.el5_11 | 1.7.0-openjdk-1:1.7.0.95-2.6.4.1.el5_11 |
| redhat/java | <1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5 | 1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5 |
| redhat/java | <1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5 | 1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5 |
| redhat/nss | <0:3.19.1-8.el6_7 | 0:3.19.1-8.el6_7 |
| redhat/openssl | <0:1.0.1e-42.el6_7.2 | 0:1.0.1e-42.el6_7.2 |
| redhat/gnutls | <0:2.8.5-19.el6_7 | 0:2.8.5-19.el6_7 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.71-1.b15.el6_7 | 1.8.0-openjdk-1:1.8.0.71-1.b15.el6_7 |
| redhat/java | <1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el6_7 | 1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el6_7 |
| redhat/java | <1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7 | 1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7 |
| redhat/java | <1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7 | 1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7 |
| redhat/nss | <0:3.19.1-19.el7_2 | 0:3.19.1-19.el7_2 |
| redhat/openssl | <1:1.0.1e-51.el7_2.2 | 1:1.0.1e-51.el7_2.2 |
| redhat/gnutls | <0:3.3.8-14.el7_2 | 0:3.3.8-14.el7_2 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.71-2.b15.el7_2 | 1.8.0-openjdk-1:1.8.0.71-2.b15.el7_2 |
| redhat/java | <1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el7_2 | 1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el7_2 |
| redhat/java | <1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7 |
| redhat/java | <1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7 | 1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7 |
| redhat/java | <1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5 | 1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5 |
| redhat/java | <1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7 | 1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7 |
| redhat/spacewalk-java | <0:2.0.2-109.el6 | 0:2.0.2-109.el6 |
| redhat/spacewalk-java | <0:2.3.8-146.el6 | 0:2.3.8-146.el6 |
| Mozilla Network Security Services | <=3.20.1 | |
| openSUSE Leap | =42.1 | |
| openSUSE openSUSE | =13.1 | |
| openSUSE openSUSE | =13.2 | |
| Mozilla Firefox ESR | =38.0 | |
| Mozilla Firefox ESR | =38.0.1 | |
| Mozilla Firefox ESR | =38.0.5 | |
| Mozilla Firefox ESR | =38.1.0 | |
| Mozilla Firefox ESR | =38.1.1 | |
| Mozilla Firefox ESR | =38.2.0 | |
| Mozilla Firefox ESR | =38.2.1 | |
| Mozilla Firefox ESR | =38.3.0 | |
| Mozilla Firefox ESR | =38.4.0 | |
| Mozilla Firefox ESR | =38.5.0 | |
| Mozilla Firefox ESR | =38.5.1 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.04 | |
| Canonical Ubuntu Linux | =15.10 | |
| Mozilla Firefox | <=43.0.1 | |
| Mozilla Firefox | =38.0 | |
| Mozilla Firefox | =38.0.1 | |
| Mozilla Firefox | =38.0.5 | |
| Mozilla Firefox | =38.1.0 | |
| Mozilla Firefox | =38.1.1 | |
| Mozilla Firefox | =38.2.0 | |
| Mozilla Firefox | =38.2.1 | |
| Mozilla Firefox | =38.3.0 | |
| Mozilla Firefox | =38.4.0 | |
| Mozilla Firefox | =38.5.0 | |
| Mozilla Firefox | =38.5.1 | |
| IBM Cognos Analytics | <=12.0.0-12.0.3 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2015-7575 https://nvd.nist.gov/vuln/detail/CVE-2015-7575 http://www.mitls.org/pages/attacks/SLOTH https://access.redhat.com/articles/2112261 https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/
- https://bugzilla.redhat.com/show_bug.cgi?id=1289841
- https://access.redhat.com/errata/RHSA-2016:0056
- https://access.redhat.com/errata/RHSA-2016:0055
- https://access.redhat.com/errata/RHSA-2016:0054
- https://access.redhat.com/errata/RHSA-2016:0100
- https://access.redhat.com/errata/RHSA-2016:0101
- https://access.redhat.com/errata/RHSA-2016:0007
- https://access.redhat.com/errata/RHSA-2016:0008
- https://access.redhat.com/errata/RHSA-2016:0012
- https://access.redhat.com/errata/RHSA-2016:0050
- https://access.redhat.com/errata/RHSA-2016:0053
- https://access.redhat.com/errata/RHSA-2016:0099
- https://access.redhat.com/errata/RHSA-2016:0049
- https://access.redhat.com/errata/RHSA-2016:0098
- https://access.redhat.com/errata/RHSA-2016:1430
- https://access.redhat.com/security/cve/CVE-2015-7575
- https://github.com/openssl/openssl/commit/45473632c54947859a731dfe2db087c002ef7aa7
- https://access.redhat.com/articles/2112261
- http://www.mitls.org/pages/attacks/SLOTH
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1296221
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1296219
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1296218
- https://rhn.redhat.com/errata/RHSA-2016-0007.html
- https://rhn.redhat.com/errata/RHSA-2016-0012.html
- https://rhn.redhat.com/errata/RHSA-2016-0008.html
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/1ad1d1b46fef
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixJAVA
- https://rhn.redhat.com/errata/RHSA-2016-0050.html
- https://rhn.redhat.com/errata/RHSA-2016-0049.html
- https://rhn.redhat.com/errata/RHSA-2016-0056.html
- https://rhn.redhat.com/errata/RHSA-2016-0055.html
- https://rhn.redhat.com/errata/RHSA-2016-0053.html
- https://rhn.redhat.com/errata/RHSA-2016-0054.html
- https://rhn.redhat.com/errata/RHSA-2016-0101.html
- https://rhn.redhat.com/errata/RHSA-2016-0100.html
- https://rhn.redhat.com/errata/RHSA-2016-0098.html
- https://rhn.redhat.com/errata/RHSA-2016-0099.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html
- http://rhn.redhat.com/errata/RHSA-2016-0049.html
- http://rhn.redhat.com/errata/RHSA-2016-0050.html
- http://rhn.redhat.com/errata/RHSA-2016-0053.html
- http://rhn.redhat.com/errata/RHSA-2016-0054.html
- http://rhn.redhat.com/errata/RHSA-2016-0055.html
- http://rhn.redhat.com/errata/RHSA-2016-0056.html
- http://www.debian.org/security/2016/dsa-3436
- http://www.debian.org/security/2016/dsa-3437
- http://www.debian.org/security/2016/dsa-3457
- http://www.debian.org/security/2016/dsa-3458
- http://www.debian.org/security/2016/dsa-3465
- http://www.debian.org/security/2016/dsa-3491
- http://www.debian.org/security/2016/dsa-3688
- http://www.mozilla.org/security/announce/2015/mfsa2015-150.html
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/79684
- http://www.securityfocus.com/bid/91787
- http://www.securitytracker.com/id/1034541
- http://www.securitytracker.com/id/1036467
- http://www.ubuntu.com/usn/USN-2863-1
- http://www.ubuntu.com/usn/USN-2864-1
- http://www.ubuntu.com/usn/USN-2865-1
- http://www.ubuntu.com/usn/USN-2866-1
- http://www.ubuntu.com/usn/USN-2884-1
- http://www.ubuntu.com/usn/USN-2904-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=1158489
- https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes
- https://security.gentoo.org/glsa/201701-46
- https://security.gentoo.org/glsa/201706-18
- https://security.gentoo.org/glsa/201801-15
- https://security.netapp.com/advisory/ntap-20160225-0001/
- https://www.ibm.com/support/pages/node/7177223 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-7575
- agent/severity
- agent/weakness
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/ibm-support
- source/IBM
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/trending
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla network security services
- version/mozilla network security services/3.20.1
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/42.1
- canonical/opensuse opensuse
- version/opensuse opensuse/13.1
- version/opensuse opensuse/13.2
- canonical/mozilla firefox esr
- version/mozilla firefox esr/38.0
- version/mozilla firefox esr/38.0.1
- version/mozilla firefox esr/38.0.5
- version/mozilla firefox esr/38.1.0
- version/mozilla firefox esr/38.1.1
- version/mozilla firefox esr/38.2.0
- version/mozilla firefox esr/38.2.1
- version/mozilla firefox esr/38.3.0
- version/mozilla firefox esr/38.4.0
- version/mozilla firefox esr/38.5.0
- version/mozilla firefox esr/38.5.1
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.04
- version/canonical ubuntu linux/15.10
- canonical/mozilla firefox
- version/mozilla firefox/43.0.1
- version/mozilla firefox/38.0
- version/mozilla firefox/38.0.1
- version/mozilla firefox/38.0.5
- version/mozilla firefox/38.1.0
- version/mozilla firefox/38.1.1
- version/mozilla firefox/38.2.0
- version/mozilla firefox/38.2.1
- version/mozilla firefox/38.3.0
- version/mozilla firefox/38.4.0
- version/mozilla firefox/38.5.0
- version/mozilla firefox/38.5.1
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.3
- version/ibm cognos analytics/11.2.0-11.2.4 fp4