What’s Vulnerable › Vulnerabilities

CVE-2015-4000

• Severity: low (CVSS 3.7 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 99.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-05-21 · updated 2026-06-17
• Weakness: CWE-310

Description

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

Affected products

• Apple Iphone Os: through 8.3
• macOS: through 10.10.3
• Apple Safari: all versions
• Canonical Ubuntu Linux: 12.04, 14.04, 14.10, 15.04
• Debian Linux: 7.0, 8.0
• Google Chrome: all versions
• Hewlett Packard Enterprise (HPE) HP-UX: b.11.31
• IBM Content Manager: 8.5
• Microsoft Internet Explorer 11: all versions
• Mozilla Firefox: 38.1.0, 39.0
• Mozilla Firefox ESR: 31.8
• Mozilla Firefox Os: 2.2
• Mozilla Network Security Services: 3.19
• Mozilla Seamonkey: 2.35
• Mozilla Thunderbird: 31.8, 38.1
• OpenSSL: from 1.0.1 through 1.0.1m; from 1.0.2 through 1.0.2a; through 1.0.1m
• Opera Browser: all versions
• Oracle Java SE: 1.6.0-update95, 1.7.0-update75, 1.7.0-update80, 1.8.0-update_33, 1.8.0-update45
• Oracle Java SE: 1.6.0-update_95, 1.7.0-update_75, 1.7.0-update_80, 1.8.0-update_33, 1.8.0-update_45
• Oracle JRockit: r28.3.6
• Oracle Sparc-Opl Service Processor: through 1121
• SUSE Linux Enterprise Server 15 SP1: 12
• SUSE Linux Enterprise Server: 11.0-sp4
• SUSE Linux Enterprise Software Development Kit: 12
• SUSE Linux Enterprise: 12

References

• http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc
• http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc
• http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402
• http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727
• http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
• http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html

Get alerted when CVE-2015-4000 or the next vulnerability affects your stack