CVE-2020-1968
First published: Wed Sep 09 2020(Updated: )
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).
Credit: openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenSSL OpenSSL | >=1.0.2<=1.0.2v | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Debian Debian Linux | =9.0 | |
| Oracle Jd Edwards World Security | =a9.4 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.56 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.57 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.58 | |
| Oracle Ethernet Switch Es2-64 Firmware | =2.0.0.14 | |
| Oracle Ethernet Switch Es2-64 | ||
| Oracle Ethernet Switch Es2-72 Firmware | =2.0.0.14 | |
| Oracle Ethernet Switch Es2-72 | ||
| Fujitsu M10-1 Firmware | <xcp2400 | |
| Fujitsu M10-1 | ||
| Fujitsu M10-4 Firmware | <xcp2400 | |
| Fujitsu M10-4 | ||
| Fujitsu M10-4s Firmware | <xcp2400 | |
| Fujitsu M10-4s | ||
| Fujitsu M12-1 Firmware | <xcp2400 | |
| Fujitsu M12-1 | ||
| Fujitsu M12-2 Firmware | <xcp2400 | |
| Fujitsu M12-2 | ||
| Fujitsu M12-2s Firmware | <xcp2400 | |
| Fujitsu M12-2s | ||
| Fujitsu M10-1 Firmware | <xcp3100 | |
| Fujitsu M10-4 Firmware | <xcp3100 | |
| Fujitsu M10-4s Firmware | <xcp3100 | |
| Fujitsu M12-1 Firmware | <xcp3100 | |
| Fujitsu M12-2 Firmware | <xcp3100 | |
| Fujitsu M12-2s Firmware | <xcp3100 | |
| Oracle Ethernet Switch Es1-24 Firmware | =1.3.1 | |
| Oracle Ethernet Switch Es1-24 | ||
| Oracle Ethernet Switch Tor-72 Firmware | =1.2.2 | |
| Oracle Ethernet Switch Tor-72 | ||
| All of | ||
| Oracle Ethernet Switch Es2-64 Firmware | =2.0.0.14 | |
| Oracle Ethernet Switch Es2-64 | ||
| All of | ||
| Oracle Ethernet Switch Es2-72 Firmware | =2.0.0.14 | |
| Oracle Ethernet Switch Es2-72 | ||
| All of | ||
| Fujitsu M10-1 Firmware | <xcp2400 | |
| Fujitsu M10-1 | ||
| All of | ||
| Fujitsu M10-4 Firmware | <xcp2400 | |
| Fujitsu M10-4 | ||
| All of | ||
| Fujitsu M10-4s Firmware | <xcp2400 | |
| Fujitsu M10-4s | ||
| All of | ||
| Fujitsu M12-1 Firmware | <xcp2400 | |
| Fujitsu M12-1 | ||
| All of | ||
| Fujitsu M12-2 Firmware | <xcp2400 | |
| Fujitsu M12-2 | ||
| All of | ||
| Fujitsu M12-2s Firmware | <xcp2400 | |
| Fujitsu M12-2s | ||
| All of | ||
| Fujitsu M10-1 Firmware | <xcp3100 | |
| Fujitsu M10-1 | ||
| All of | ||
| Fujitsu M10-4 Firmware | <xcp3100 | |
| Fujitsu M10-4 | ||
| All of | ||
| Fujitsu M10-4s Firmware | <xcp3100 | |
| Fujitsu M10-4s | ||
| All of | ||
| Fujitsu M12-1 Firmware | <xcp3100 | |
| Fujitsu M12-1 | ||
| All of | ||
| Fujitsu M12-2 Firmware | <xcp3100 | |
| Fujitsu M12-2 | ||
| All of | ||
| Fujitsu M12-2s Firmware | <xcp3100 | |
| Fujitsu M12-2s | ||
| All of | ||
| Oracle Ethernet Switch Es1-24 Firmware | =1.3.1 | |
| Oracle Ethernet Switch Es1-24 | ||
| All of | ||
| Oracle Ethernet Switch Tor-72 Firmware | =1.2.2 | |
| Oracle Ethernet Switch Tor-72 | ||
| ubuntu/openssl | <1.0.2 | 1.0.2 |
| ubuntu/openssl1.0 | <1.0.2 | 1.0.2 |
| debian/openssl | 1.1.1n-0+deb10u3 1.1.1n-0+deb10u6 1.1.1w-0+deb11u1 1.1.1n-0+deb11u5 3.0.11-1~deb12u2 3.2.1-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.debian.org/debian-lts-announce/2020/09/msg00016.html
- https://security.gentoo.org/glsa/202210-02
- https://security.netapp.com/advisory/ntap-20200911-0004/
- https://usn.ubuntu.com/4504-1/
- https://www.openssl.org/news/secadv/20200909.txt
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://launchpad.net/bugs/cve/CVE-2020-1968
- https://raccoon-attack.com/
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bc71f91064a3eec10310fa4cc14fe2a3fd9bc7bb
- https://security-tracker.debian.org/tracker/CVE-2020-1968
- https://ubuntu.com/security/notices/USN-4504-1
- https://www.cve.org/CVERecord?id=CVE-2020-1968
- https://nvd.nist.gov/vuln/detail/CVE-2020-1968
- https://ubuntu.com/security/CVE-2020-1968
Frequently Asked Questions
What is CVE-2020-1968?
CVE-2020-1968 is a vulnerability that exploits a flaw in the TLS specification, allowing an attacker to compute the pre-master secret in connections using a Diffie-Hellman based cipher suite.
What is the severity of CVE-2020-1968?
The severity of CVE-2020-1968 is medium, with a severity value of 3.7.
Which software versions are affected by CVE-2020-1968?
CVE-2020-1968 affects OpenSSL versions up to but excluding 1.0.2 and 1.1.1n-0+deb10u3, 1.1.1n-0+deb10u6, 1.1.1w-0+deb11u1, 1.1.1n-0+deb11u5, 3.0.11-1~deb12u1, 3.0.11-1~deb12u2, 3.0.11-1, 3.0.12-1.
How can I fix CVE-2020-1968?
To fix CVE-2020-1968, you should update your OpenSSL software to a version that includes the security patch.
Where can I find more information about CVE-2020-1968?
You can find more information about CVE-2020-1968 on the official OpenSSL website and the provided references.
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/tags
- agent/event
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/1.0.2
- version/openssl openssl/1.0.2v
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/oracle
- canonical/oracle jd edwards world security
- version/oracle jd edwards world security/a9.4
- canonical/oracle peoplesoft enterprise peopletools
- version/oracle peoplesoft enterprise peopletools/8.56
- version/oracle peoplesoft enterprise peopletools/8.57
- version/oracle peoplesoft enterprise peopletools/8.58
- canonical/oracle ethernet switch es2-64 firmware
- version/oracle ethernet switch es2-64 firmware/2.0.0.14
- canonical/oracle ethernet switch es2-64
- canonical/oracle ethernet switch es2-72 firmware
- version/oracle ethernet switch es2-72 firmware/2.0.0.14
- canonical/oracle ethernet switch es2-72
- vendor/fujitsu
- canonical/fujitsu m10-1 firmware
- canonical/fujitsu m10-1
- canonical/fujitsu m10-4 firmware
- canonical/fujitsu m10-4
- canonical/fujitsu m10-4s firmware
- canonical/fujitsu m10-4s
- canonical/fujitsu m12-1 firmware
- canonical/fujitsu m12-1
- canonical/fujitsu m12-2 firmware
- canonical/fujitsu m12-2
- canonical/fujitsu m12-2s firmware
- canonical/fujitsu m12-2s
- canonical/oracle ethernet switch es1-24 firmware
- version/oracle ethernet switch es1-24 firmware/1.3.1
- canonical/oracle ethernet switch es1-24
- canonical/oracle ethernet switch tor-72 firmware
- version/oracle ethernet switch tor-72 firmware/1.2.2
- canonical/oracle ethernet switch tor-72
- package-manager/debian
- package-manager/ubuntu