PT-2012-2073 · Openssl+1 · Openssl+1

Published 2012-06-20 · Updated 2014-10-24 · CVE-2011-5095

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL version 0.9.8

Description The issue affects the Diffie-Hellman key-exchange implementation when FIPS mode is enabled, allowing man-in-the-middle attackers to obtain the shared secret key by modifying network traffic.

Recommendations For OpenSSL version 0.9.8, update to a version that properly validates public parameters in the Diffie-Hellman key-exchange implementation to prevent man-in-the-middle attacks.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-5095

SUSE-SU-2012_0885-1

SUSE-SU-2015:1184-1

SUSE-SU-403

Affected Products

Openssl

Suse

References · 134

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5095 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-5095 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-5095 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-5095 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-5095 · Vendor Advisory
• https://suse.com/security/cve/CVE-2006-7250 · Note
• https://bugzilla.suse.com/739719 · Note
• http://nessus.org/plugins/index.php?view=single&id=53360 · Note
• https://suse.com/security/cve/CVE-2015-0204 · Note
• https://suse.com/security/cve/CVE-2009-5146 · Note
• https://suse.com/security/cve/CVE-2014-3513 · Note
• https://bugzilla.suse.com/922499 · Note
• https://suse.com/security/cve/CVE-2012-2110 · Note
• https://suse.com/security/cve/CVE-2012-1165 · Note