Skip to main content

Early Access — Mondoo Vulnerability Intelligence is currently in preview.

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

CVE-2015-4000

LOW3.7

The TLS protocol 1

Published May 21, 2015

Modified 1 years ago

No fix available

Details

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

References

WEBhttp://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc WEBhttp://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery ADVISORYhttp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc WEBhttp://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402 WEBhttp://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778 WEBhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681 WEBhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 ADVISORYhttp://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html ADVISORYhttp://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html ADVISORYhttp://lists.opensuse.org/opensuse-updates/2015-07/msg00016.html ADVISORYhttp://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html ADVISORYhttp://lists.opensuse.org/opensuse-updates/2016-02/msg00094.html ADVISORYhttp://lists.opensuse.org/opensuse-updates/2016-02/msg00097.html ADVISORYhttp://marc.info/?l=bugtraq&m=143506486712441&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=143557934009303&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=143558092609708&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=143628304012255&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=143637549705650&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=143655800220052&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=143880121627664&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144043644216842&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144050121701297&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144060576831314&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144060606031437&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144061542602287&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144069189622016&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144102017024820&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144104533800819&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=144493176821532&w=2 ADVISORYhttp://marc.info/?l=bugtraq&m=145409266329539&w=2 WEBhttp://openwall.com/lists/oss-security/2015/05/20/8 ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1072.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1185.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1197.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1228.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1229.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1230.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1241.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1242.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1243.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1485.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1486.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1488.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1526.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1544.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2015-1604.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2016-1624.html ADVISORYhttp://rhn.redhat.com/errata/RHSA-2016-2056.html WEBhttp://support.apple.com/kb/HT204941 WEBhttp://support.apple.com/kb/HT204942 WEBhttp://support.citrix.com/article/CTX201114 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959111 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959195 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959325 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959453 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959481 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959517 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959530 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959539 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959636 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21959812 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21960191 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21961717 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21962455 WEBhttp://www-01.ibm.com/support/docview.wss?uid=swg21962739 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21958984 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21959132 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21960041 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21960194 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21960380 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21960418 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21962816 WEBhttp://www-304.ibm.com/support/docview.wss?uid=swg21967893 ADVISORYhttp://www.debian.org/security/2015/dsa-3287 ADVISORYhttp://www.debian.org/security/2015/dsa-3300 ADVISORYhttp://www.debian.org/security/2015/dsa-3316 ADVISORYhttp://www.debian.org/security/2015/dsa-3324 ADVISORYhttp://www.debian.org/security/2015/dsa-3339 ADVISORYhttp://www.debian.org/security/2016/dsa-3688 WEBhttp://www.fortiguard.com/advisory/2015-05-20-logjam-attack WEBhttp://www.mozilla.org/security/announce/2015/mfsa2015-70.html WEBhttp://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html WEBhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html WEBhttp://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html WEBhttp://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html WEBhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html WEBhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html WEBhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html WEBhttp://www.securityfocus.com/bid/74733 WEBhttp://www.securityfocus.com/bid/91787 WEBhttp://www.securitytracker.com/id/1032474 WEBhttp://www.securitytracker.com/id/1032475 WEBhttp://www.securitytracker.com/id/1032476 WEBhttp://www.securitytracker.com/id/1032637 WEBhttp://www.securitytracker.com/id/1032645 WEBhttp://www.securitytracker.com/id/1032647 WEBhttp://www.securitytracker.com/id/1032648 WEBhttp://www.securitytracker.com/id/1032649 WEBhttp://www.securitytracker.com/id/1032650 WEBhttp://www.securitytracker.com/id/1032651 WEBhttp://www.securitytracker.com/id/1032652 WEBhttp://www.securitytracker.com/id/1032653 WEBhttp://www.securitytracker.com/id/1032654 WEBhttp://www.securitytracker.com/id/1032655 WEBhttp://www.securitytracker.com/id/1032656 WEBhttp://www.securitytracker.com/id/1032688 WEBhttp://www.securitytracker.com/id/1032699 WEBhttp://www.securitytracker.com/id/1032702 WEBhttp://www.securitytracker.com/id/1032727 WEBhttp://www.securitytracker.com/id/1032759 WEBhttp://www.securitytracker.com/id/1032777 WEBhttp://www.securitytracker.com/id/1032778 WEBhttp://www.securitytracker.com/id/1032783 WEBhttp://www.securitytracker.com/id/1032784 WEBhttp://www.securitytracker.com/id/1032856 WEBhttp://www.securitytracker.com/id/1032864 WEBhttp://www.securitytracker.com/id/1032865 WEBhttp://www.securitytracker.com/id/1032871 WEBhttp://www.securitytracker.com/id/1032884 WEBhttp://www.securitytracker.com/id/1032910 WEBhttp://www.securitytracker.com/id/1032932 WEBhttp://www.securitytracker.com/id/1032960 WEBhttp://www.securitytracker.com/id/1033019 WEBhttp://www.securitytracker.com/id/1033064 WEBhttp://www.securitytracker.com/id/1033065 WEBhttp://www.securitytracker.com/id/1033067 WEBhttp://www.securitytracker.com/id/1033208 WEBhttp://www.securitytracker.com/id/1033209 WEBhttp://www.securitytracker.com/id/1033210 WEBhttp://www.securitytracker.com/id/1033222 WEBhttp://www.securitytracker.com/id/1033341 WEBhttp://www.securitytracker.com/id/1033385 WEBhttp://www.securitytracker.com/id/1033416 WEBhttp://www.securitytracker.com/id/1033430 WEBhttp://www.securitytracker.com/id/1033433 WEBhttp://www.securitytracker.com/id/1033513 WEBhttp://www.securitytracker.com/id/1033760 WEBhttp://www.securitytracker.com/id/1033891 WEBhttp://www.securitytracker.com/id/1033991 WEBhttp://www.securitytracker.com/id/1034087 WEBhttp://www.securitytracker.com/id/1034728 WEBhttp://www.securitytracker.com/id/1034884 WEBhttp://www.securitytracker.com/id/1036218 WEBhttp://www.securitytracker.com/id/1040630 WEBhttp://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/releaseNotes.htm ADVISORYhttp://www.ubuntu.com/usn/USN-2656-1 ADVISORYhttp://www.ubuntu.com/usn/USN-2656-2 ADVISORYhttp://www.ubuntu.com/usn/USN-2673-1 ADVISORYhttp://www.ubuntu.com/usn/USN-2696-1 ADVISORYhttp://www.ubuntu.com/usn/USN-2706-1 WEBhttps://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/WEBhttps://bto.bluecoat.com/security-advisory/sa98 WEBhttps://bugzilla.mozilla.org/show_bug.cgi?id=1138554 WEBhttps://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf WEBhttps://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes ADVISORYhttps://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04718196 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04918839 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923929 WEBhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789 WEBhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04740527 WEBhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04953655 WEBhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 WEBhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128722 WEBhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193083 WEBhttps://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes WEBhttps://kc.mcafee.com/corporate/index?page=content&id=SB10122 WEBhttps://openssl.org/news/secadv/20150611.txt WEBhttps://puppet.com/security/cve/CVE-2015-4000 ADVISORYhttps://security.gentoo.org/glsa/201506-02 ADVISORYhttps://security.gentoo.org/glsa/201512-10 ADVISORYhttps://security.gentoo.org/glsa/201603-11 ADVISORYhttps://security.gentoo.org/glsa/201701-46 WEBhttps://security.netapp.com/advisory/ntap-20150619-0001/WEBhttps://support.citrix.com/article/CTX216642 WEBhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_us WEBhttps://weakdh.org/WEBhttps://weakdh.org/imperfect-forward-secrecy.pdf WEBhttps://www-304.ibm.com/support/docview.wss?uid=swg21959745 WEBhttps://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2015-4000 WEBhttps://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/WEBhttps://www.openssl.org/news/secadv_20150611.txt WEBhttps://www.oracle.com/security-alerts/cpujan2021.html WEBhttps://www.suse.com/security/cve/CVE-2015-4000.html

CVSS Analysis

CVSS v3.0

3.7

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

3.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Ecosystems

Timeline

PublishedMay 21, 2015

ModifiedAug 6, 2024

CVE-2015-4000 | Mondoo Vulnerability Intelligence