VulnerabilityAnalyzed

CVE-2002-20001

HIGH 7.5EPSS 24.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 24.6%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 24.64% probability · 98th percentile
CISA KEV: Not listed
Weakness: CWE-400
Affected: balasys/dheater · siemens/scalance w1750d firmware · suse/linux enterprise server · f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip advanced web application firewall · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip application visibility and reporting · f5/big-ip carrier-grade nat · f5/big-ip ddos hybrid defender · f5/big-ip domain name system · f5/big-ip edge gateway · f5/big-ip fraud protection service · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip policy enforcement manager · f5/big-ip service proxy · +10 more
Source: cve@mitre.org

References

https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfThird Party Advisory
https://dheatattack.comThird Party Advisory
https://dheatattack.gitlab.io/Third Party Advisory
https://github.com/Balasys/dheaterProduct, Third Party Advisory
https://github.com/mozilla/ssl-config-generator/issues/162Issue Tracking
https://gitlab.com/dheatattack/dheaterThird Party Advisory
https://ieeexplore.ieee.org/document/10374117Technical Description, Third Party Advisory
https://support.f5.com/csp/article/K83120834Third Party Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txtTechnical Description, Third Party Advisory
https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/Third Party Advisory
https://www.reddit.com/r/netsec/comments/qdoosy/server_overload_by_enforcing_dhe_key_exchange/Issue Tracking
https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_ProtocolExploit, Technical Description
https://www.suse.com/support/kb/doc/?id=000020510Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdfThird Party Advisory
https://dheatattack.comThird Party Advisory
https://dheatattack.gitlab.io/Third Party Advisory
https://github.com/Balasys/dheaterProduct, Third Party Advisory
https://github.com/mozilla/ssl-config-generator/issues/162Issue Tracking
https://gitlab.com/dheatattack/dheaterThird Party Advisory
https://ieeexplore.ieee.org/document/10374117Technical Description, Third Party Advisory
https://support.f5.com/csp/article/K83120834Third Party Advisory
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txtTechnical Description, Third Party Advisory
https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/Third Party Advisory
https://www.reddit.com/r/netsec/comments/qdoosy/server_overload_by_enforcing_dhe_key_exchange/Issue Tracking
https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_ProtocolExploit, Technical Description
https://www.suse.com/support/kb/doc/?id=000020510Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.