VulnerabilityModified

CVE-2015-4000

LOW 3.7EPSS 99.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 99.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

CVSS 3.1: 3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 99.86% probability · 100th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-310, CWE-295
Affected: openssl/openssl · canonical/ubuntu linux · hp/hp-ux · ibm/content manager · oracle/jrockit · debian/debian linux · oracle/jdk · oracle/jre · suse/linux enterprise desktop · suse/linux enterprise server · suse/linux enterprise software development kit · suse/suse linux enterprise server · apple/iphone os · apple/mac os x · mozilla/network security services · oracle/sparc-opl service processor · apple/safari · google/chrome · microsoft/internet explorer · mozilla/firefox · +5 more
Source: cve@mitre.org

EPSS trend

EPSS 99.9% since 4 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.ascThird Party Advisory
http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgeryThird Party Advisory
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.ascMailing List, Third Party Advisory
http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402Third Party Advisory
http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.htmlMailing List, Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.