p PatchFirst

CVE-2005-2969

CVE-2005-2969

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.

EPSS 4.9% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • openssl Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.9.8-3

    Update to 0.9.8-3

  • openssl Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.9.8-3

    Update to 0.9.8-3

  • openssl Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.9.8-3

    Update to 0.9.8-3

Original sources

Check your server →