CVE-2015-3197
Medium
Description
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Openssl
PublishedFeb 15, 2016
First seenFeb 15, 2016
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openssl openssl | 1.0.1, 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, 1.0.1e, 1.0.1f, 1.0.1g, 1.0.1h, 1.0.1i, 1.0.1j, 1.0.1k, 1.0.1l, 1.0.1m, 1.0.1n, 1.0.1o, 1.0.1p, 1.0.1q, 1.0.2, 1.0.2a, 1.0.2b, 1.0.2c, 1.0.2d, 1.0.2e | — |
| oracle tuxedo | 12.1.1.0 | — |
| oracle exalogic_infrastructure | 1.0, 2.0 | — |
| oracle peoplesoft_enterprise_peopletools | 8.53, 8.54, 8.55 | — |
| oracle oss_support_tools | 8.11.16.3.8 | — |
| oracle vm_virtualbox | 5.0.16 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.