What’s Vulnerable › Vulnerabilities

CVE-2015-3197

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-02-15 · updated 2026-06-17
• Weakness: CWE-200

Description

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

Affected products

• OpenSSL: 1.0.1, 1.0.1-beta1, 1.0.1-beta2, 1.0.1-beta3, 1.0.1a, 1.0.1b (+24)
• Oracle Exalogic Infrastructure: 1.0, 2.0
• Oracle Corporation OSS Support Tools: 8.11.16.3.8
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.53, 8.54, 8.55
• Oracle Corporation Tuxedo: 12.1.1.0
• Oracle Corporation VM VirtualBox: 5.0.16

References

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
• http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00012.html

Get alerted when CVE-2015-3197 or the next vulnerability affects your stack