NVD

Id
22707  
Name
CVE-2015-0205  
Description
The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-01-08  
Modified Date
2017-01-02  
Seq
2015-0205  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
119999 22707 CVE-2015-0205 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679  View
120000 22707 CVE-2015-0205 FEDORA-2015-0512  View
120001 22707 CVE-2015-0205 FEDORA-2015-0601  View
120002 22707 CVE-2015-0205 openSUSE-SU-2015:0130  View
120003 22707 CVE-2015-0205 SUSE-SU-2015:0578  View
120004 22707 CVE-2015-0205 SUSE-SU-2015:0946  View
120005 22707 CVE-2015-0205 openSUSE-SU-2015:1277  View
120006 22707 CVE-2015-0205 HPSBHF03289  View
120007 22707 CVE-2015-0205 HPSBMU03380  View
120008 22707 CVE-2015-0205 HPSBMU03409  View
120009 22707 CVE-2015-0205 HPSBMU03396  View
120010 22707 CVE-2015-0205 HPSBMU03413  View
120011 22707 CVE-2015-0205 HPSBMU03397  View
120012 22707 CVE-2015-0205 RHSA-2015:0066  View
120013 22707 CVE-2015-0205 20150310 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products  View
120014 22707 CVE-2015-0205 DSA-3125  View
120015 22707 CVE-2015-0205 MDVSA-2015:019  View
120016 22707 CVE-2015-0205 MDVSA-2015:062  View
120017 22707 CVE-2015-0205 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html  View
120018 22707 CVE-2015-0205 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html  View
120019 22707 CVE-2015-0205 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html  View
120020 22707 CVE-2015-0205 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html  View
120021 22707 CVE-2015-0205 http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html  View
120022 22707 CVE-2015-0205 71941  View
120023 22707 CVE-2015-0205 91787  View
120024 22707 CVE-2015-0205 1033378  View
120025 22707 CVE-2015-0205 openssl-cve20150205-sec-bypass(99708)  View
120026 22707 CVE-2015-0205 https://bto.bluecoat.com/security-advisory/sa88  View
120027 22707 CVE-2015-0205 https://github.com/openssl/openssl/commit/1421e0c584ae9120ca1b88098f13d6d2e90b83a3  View
120028 22707 CVE-2015-0205 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888  View
120029 22707 CVE-2015-0205 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380  View
120030 22707 CVE-2015-0205 https://kc.mcafee.com/corporate/index?page=content&id=SB10102  View
120031 22707 CVE-2015-0205 https://kc.mcafee.com/corporate/index?page=content&id=SB10108  View
120032 22707 CVE-2015-0205 https://www.openssl.org/news/secadv_20150108.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
5690 JVNDB-2015-001010 OpenSSL の s3_srvr.c の ssl3_get_cert_verify 関数におけるアクセス権を取得される脆弱性 OpenSSL の s3_srvr.c の ssl3_get_cert_verify 関数は、CertificateVerify メッセージを必要としない Diffie-Hellman (DH) 証明書を伴うクライアント認証を受け入れるため、アクセス権を取得される脆弱性が存在します。 CVE-2015-0205 77416 CVE-2015-0205 22707 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001010.html 2015-01-08 2016-09-30 View