QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2015-0205

Back to search

CVE-2015-0205

Published: Jan 9, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.

VendorProductVersions

n/a

n/a

affected
n/a

References

openSUSE-SU-2015:0130
vendor-advisory
x_refsource_SUSE
HPSBMU03409
vendor-advisory
x_refsource_HP
71941
vdb-entry
x_refsource_BID
HPSBMU03380
vendor-advisory
x_refsource_HP
FEDORA-2015-0601
vendor-advisory
x_refsource_FEDORA
1033378
vdb-entry
x_refsource_SECTRACK
HPSBHF03289
vendor-advisory
x_refsource_HP
MDVSA-2015:019
vendor-advisory
x_refsource_MANDRIVA
openSUSE-SU-2015:1277
vendor-advisory
x_refsource_SUSE
RHSA-2015:0066
vendor-advisory
x_refsource_REDHAT
SUSE-SU-2015:0578
vendor-advisory
x_refsource_SUSE
SUSE-SU-2015:0946
vendor-advisory
x_refsource_SUSE
HPSBMU03397
vendor-advisory
x_refsource_HP
91787
vdb-entry
x_refsource_BID
HPSBMU03396
vendor-advisory
x_refsource_HP
MDVSA-2015:062
vendor-advisory
x_refsource_MANDRIVA
HPSBMU03413
vendor-advisory
x_refsource_HP
DSA-3125
vendor-advisory
x_refsource_DEBIAN
FEDORA-2015-0512
vendor-advisory
x_refsource_FEDORA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now