CVE-2015-3152

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-05-16 · updated 2026-06-17
Weakness: CWE-295

Description

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

Affected products

Debian Linux: 8.0
Fedoraproject Fedora: 21, 22
MariaDB: from 5.5.0 before 5.5.44; from 10.0.0 before 10.0.20 — fixed in 10.0.20, 5.5.44
MySQL Server: through 5.7.2
Oracle Mysql Connector/C: through 6.1.2
PHP: from 5.4.0 before 5.4.43; from 5.5.0 before 5.5.27; from 5.6.0 before 5.6.11 — fixed in 5.4.43, 5.5.27, 5.6.11
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Eus: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6 (+1)
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6, 7.7
RedHat Enterprise Linux Server Tus: 7.3, 7.6, 7.7
RedHat Enterprise Linux Workstation: 7.0

How to fix

Upgrade to a fixed version: MariaDB 10.0.20, 5.5.44; PHP 5.4.43, 5.5.27, 5.6.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2015-3152 or the next vulnerability affects your stack