CVE-2005-2969

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-10-18 · updated 2026-06-16

Description

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.

Affected products

OpenSSL: 0.9.7, 0.9.7a, 0.9.7b, 0.9.7c, 0.9.7d, 0.9.7e (+3)

References

http://docs.info.apple.com/article.html?artnum=302847
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100
http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540
http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
http://secunia.com/advisories/17146
http://secunia.com/advisories/17151
http://secunia.com/advisories/17153
http://secunia.com/advisories/17169
http://secunia.com/advisories/17178
http://secunia.com/advisories/17180
http://secunia.com/advisories/17189

Get alerted when CVE-2005-2969 or the next vulnerability affects your stack