CVE-2010-4180
CVE-2010-4180
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.
EPSS 9.5% · Fix available
- Published
- Updated
Affected products and versions
Original sources
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
- http://www.securitytracker.com/id?1024822
- http://secunia.com/advisories/42473
- http://secunia.com/advisories/42571
- http://secunia.com/advisories/43170
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668471
- http://www.vupen.com/english/advisories/2011/0268
- http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
- http://support.apple.com/kb/HT4723
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html
- http://secunia.com/advisories/42493
- http://secunia.com/advisories/43173
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html
- http://www.vupen.com/english/advisories/2011/0032
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html
- http://secunia.com/advisories/43171
- http://secunia.com/advisories/42620
- http://www.securityfocus.com/archive/1/522176
- http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
- http://ubuntu.com/usn/usn-1029-1
- http://www.vupen.com/english/advisories/2010/3120
- http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html
- http://www.vupen.com/english/advisories/2010/3122
- https://nvd.nist.gov/vuln/detail/CVE-2010-4180