onyx --cves cve-2010-4180
CVE-2010-4180
- score
- <0.1
- cvss
- 4.3
- epss
- 9.5%
- published
- 2010-12-06
- kev added
- —
- first seen
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, contain a cipher downgrade caused by improper session cache handling, letting remote attackers force cipher downgrades via network traffic analysis, exploit requires sniffing network traffic to discover session identifiers.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
NVD-CWE-noinfo
References 31
- http://www.vupen.com/english/advisories/2011/0268
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html
- http://ubuntu.com/usn/usn-1029-1
- http://www.redhat.com/support/errata/RHSA-2010-0979.html
- http://marc.info/?l=bugtraq&m=129916880600544&w=2
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668471
- https://bugzilla.redhat.com/show_bug.cgi?id=659462
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:248
- http://www.vupen.com/english/advisories/2010/3120
- http://www.vupen.com/english/advisories/2010/3134
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html
- http://marc.info/?l=bugtraq&m=130497251507577&w=2
- http://www.securityfocus.com/archive/1/522176
- http://www.securityfocus.com/bid/45164
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18910
- http://www.debian.org/security/2011/dsa-2141
- http://www.kb.cert.org/vuls/id/737740
- http://www.vupen.com/english/advisories/2011/0032
- http://www.vupen.com/english/advisories/2010/3122
- http://www.vupen.com/english/advisories/2010/3188
- http://www.vupen.com/english/advisories/2011/0076
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
- http://marc.info/?l=bugtraq&m=132077688910227&w=2
6 more
- http://www.redhat.com/support/errata/RHSA-2011-0896.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html
- http://openssl.org/news/secadv_20101202.txt
- http://support.apple.com/kb/HT4723
- http://www.redhat.com/support/errata/RHSA-2010-0977.html
- http://www.redhat.com/support/errata/RHSA-2010-0978.html