CVE-2015-8960
Description
The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ietf transport_layer_security | v ≤ 1.2 | — |
| netapp clustered_data_ontap_antivirus_connector | No range specified | — |
| netapp data_ontap_edge | No range specified | — |
| netapp host_agent | No range specified | — |
| netapp oncommand_shift | No range specified | — |
| netapp plug-in_for_symantec_netbackup | No range specified | — |
| netapp smi-s_provider | No range specified | — |
| netapp snap_creator_framework | No range specified | — |
| netapp snapdrive | No range specified | — |
| netapp snapmanager | No range specified | — |
| netapp snapprotect | No range specified | — |
| netapp solidfire_\&_hci_management_node | No range specified | — |
| netapp system_setup | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.