{"id":"CVE-2015-2808","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-2808","generatedAt":"2026-11-05T06:22:44.806Z","title":"The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial…","description":"The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the \"Bar Mitzvah\" issue.","published":"2015-04-01T02:00:35.000Z","lastModified":"2026-06-17T00:24:48.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-327"],"affected":["oracle/communications application session controller","oracle/communications policy management","oracle/http server","oracle/integrated lights out manager firmware","debian/debian linux","redhat/satellite","redhat/enterprise linux desktop","redhat/enterprise linux eus","redhat/enterprise linux server","redhat/enterprise linux server aus","redhat/enterprise linux server tus","redhat/enterprise linux workstation","suse/linux enterprise debuginfo","opensuse/opensuse","suse/linux enterprise desktop","suse/linux enterprise server","suse/linux enterprise software development kit","suse/manager","canonical/ubuntu linux","fujitsu/sparc enterprise m3000 firmware","fujitsu/sparc enterprise m4000 firmware","fujitsu/sparc enterprise m5000 firmware","fujitsu/sparc enterprise m8000 firmware","fujitsu/sparc enterprise m9000 firmware","huawei/e6000 firmware","huawei/e9000 firmware","huawei/oceanstor 18500 firmware","huawei/oceanstor 18800 firmware","huawei/oceanstor 18800f firmware","huawei/oceanstor 9000 firmware","huawei/oceanstor cse firmware","huawei/oceanstor hvs85t firmware","huawei/oceanstor s2600t firmware","huawei/oceanstor s5500t firmware","huawei/oceanstor s5600t firmware","huawei/oceanstor s5800t firmware","huawei/oceanstor s6800t firmware","huawei/oceanstor vis6600t firmware","huawei/quidway s9300 firmware","huawei/s7700 firmware","huawei/9700 firmware","huawei/s12700 firmware","huawei/s2700 firmware","huawei/s3700 firmware","huawei/s5700ei firmware","huawei/s5700hi firmware","huawei/s5700si firmware","huawei/s5710ei firmware","huawei/s5710hi firmware","huawei/s6700 firmware","huawei/s2750 firmware","huawei/s5700li firmware","huawei/s5700s-li firmware","huawei/s5720hi firmware","huawei/s5720ei firmware","huawei/te60 firmware","huawei/oceanstor replicationdirector","huawei/policy center","huawei/smc2.0","huawei/ultravr"],"epss":{"score":0.73851,"percentile":0.99478,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 73.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=143456209711959&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=143629696317098&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=143741441012338&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=143817021313142&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=143817899717054&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=143818140118771&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144043644216842&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144059660127919&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144059703728085&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144060576831314&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144060606031437&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144069189622016&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144102017024820&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144104533800819&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144104565600964&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=144493176821532&w=2","tags":["Issue Tracking","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1006.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1007.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1020.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1021.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1091.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1228.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1229.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1230.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1241.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1242.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1243.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1526.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21883640","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www-304.ibm.com/support/docview.wss?uid=swg21903565","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www-304.ibm.com/support/docview.wss?uid=swg21960015","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www-304.ibm.com/support/docview.wss?uid=swg21960769","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2015/dsa-3316","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2015/dsa-3339","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.huawei.com/en/psirt/security-advisories/hw-454055","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/73684","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/91787","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id/1032599","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-2808","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}