mozilla -- multiple vulnerabilitiesentered 2015-07-16
no CVE referenced
CVE details
CVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Affected ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| security/openssl-unsafe | openssl-unsafe | 1.0.2.20170706 | unaddressed | brnrd@FreeBSD.org |
VuXML
openssl -- multiple vulnerabilitiesentered 2015-06-11
no CVE referenced
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>openssl-unsafe</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is
enabled on a server but not on a client, does not properly convey a
DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct
cipher-downgrade attacks by rewriting a ClientHello with DHE replaced
by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT
replaced by DHE, aka the "Logjam" issue.</p>
</body>
</description>
<references>
<cvename>CVE-2015-4000</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2015-4000</url>
</references>
<dates>
<discovery>2015-05-21</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>