CVE-2015-4000
- State
- Published
- Severity
- 3.7 Low
- Published
- May 21, 2015
- Updated
- May 27, 2026
- Reserved
- May 15, 2015
Description
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- SUSE-SU-2015:1184vendor-advisory
- SUSE-SU-2015:1177vendor-advisory
- SSRT102180vendor-advisory
- RHSA-2015:1243vendor-advisory
- openSUSE-SU-2015:1229vendor-advisory
- 1033208vdb-entry
- 1032637vdb-entry
- HPSBGN03404vendor-advisory
- DSA-3688vendor-advisory
- DSA-3287vendor-advisory
- HPSBUX03512vendor-advisory
- 1032865vdb-entry
- HPSBGN03351vendor-advisory
- SUSE-SU-2015:1268vendor-advisory
- SUSE-SU-2015:1150vendor-advisory
- 1034728vdb-entry
- SUSE-SU-2015:1183vendor-advisory
- 1032656vdb-entry
- RHSA-2016:2056vendor-advisory
- [oss-security] 20150520 CVE-2015-4000 - TLS does not properly convey server's ciphersuite choicemailing-list
- openSUSE-SU-2015:1684vendor-advisory
- HPSBGN03361vendor-advisory
- HPSBGN03399vendor-advisory
- 1032475vdb-entry
- 1032960vdb-entry
- openSUSE-SU-2016:0255vendor-advisory
- 1032653vdb-entry
- SUSE-SU-2016:0224vendor-advisory
- 1033385vdb-entry
- GLSA-201512-10vendor-advisory
- RHSA-2015:1229vendor-advisory
- openSUSE-SU-2016:0483vendor-advisory
- 1032864vdb-entry
- 1032910vdb-entry
- 1032645vdb-entry
- USN-2706-1vendor-advisory
- GLSA-201701-46vendor-advisory
- RHSA-2015:1526vendor-advisory
- 1033760vdb-entry
- RHSA-2015:1485vendor-advisory
- RHSA-2015:1197vendor-advisory
- HPSBMU03401vendor-advisory
- 1032699vdb-entry
- 1032476vdb-entry
- 1032649vdb-entry
- HPSBMU03345vendor-advisory
- HPSBUX03363vendor-advisory
- RHSA-2015:1544vendor-advisory
- FEDORA-2015-9130vendor-advisory
- SUSE-SU-2015:1182vendor-advisory
- SSRT102112vendor-advisory
- 1032688vdb-entry
- SUSE-SU-2015:1143vendor-advisory
- 1032652vdb-entry
- FEDORA-2015-9048vendor-advisory
- RHSA-2015:1185vendor-advisory
- HPSBGN03362vendor-advisory
- APPLE-SA-2015-06-30-2vendor-advisory
- openSUSE-SU-2015:1289vendor-advisory
- FEDORA-2015-9161vendor-advisory
- HPSBGN03402vendor-advisory
- 1032648vdb-entry
- 1032759vdb-entry
- RHSA-2015:1228vendor-advisory
- HPSBGN03405vendor-advisory
- DSA-3316vendor-advisory
- 1033209vdb-entry
- 1032871vdb-entry
- DSA-3324vendor-advisory
- 1032655vdb-entry
- 1033210vdb-entry
- HPSBGN03411vendor-advisory
- openSUSE-SU-2015:1277vendor-advisory
- HPSBGN03533vendor-advisory
- USN-2673-1vendor-advisory
- 1034884vdb-entry
- HPSBMU03356vendor-advisory
- GLSA-201603-11vendor-advisory
- 1033064vdb-entry
- SUSE-SU-2015:1181vendor-advisory
- 1032778vdb-entry
- 1032474vdb-entry
- HPSBGN03407vendor-advisory
- openSUSE-SU-2015:1209vendor-advisory
- 1032784vdb-entry
- 1032777vdb-entry
- 1033416vdb-entry
- 1033991vdb-entry
- 1032647vdb-entry
- 1032654vdb-entry
- 1033341vdb-entry
- RHSA-2015:1486vendor-advisory
- SUSE-SU-2015:1663vendor-advisory
- 1033433vdb-entry
- USN-2696-1vendor-advisory
- APPLE-SA-2015-06-30-1vendor-advisory
- 1032702vdb-entry
- DSA-3339vendor-advisory
- 1032727vdb-entry
- RHSA-2015:1242vendor-advisory
- SUSE-SU-2015:1269vendor-advisory
- GLSA-201506-02vendor-advisory
- 91787vdb-entry
- RHSA-2016:1624vendor-advisory
- openSUSE-SU-2015:1266vendor-advisory
- RHSA-2015:1488vendor-advisory
- SUSE-SU-2015:1319vendor-advisory
- SUSE-SU-2015:1320vendor-advisory
- 1033430vdb-entry
- openSUSE-SU-2015:1288vendor-advisory
- RHSA-2015:1241vendor-advisory
- openSUSE-SU-2016:0478vendor-advisory
- SUSE-SU-2015:1581vendor-advisory
- RHSA-2015:1230vendor-advisory
- 74733vdb-entry
- openSUSE-SU-2016:0261vendor-advisory
- 1032651vdb-entry
- 1033065vdb-entry
- USN-2656-1vendor-advisory
- SUSE-SU-2015:1185vendor-advisory
- 1033222vdb-entry
- 1036218vdb-entry
- SUSE-SU-2015:1449vendor-advisory
- HPSBGN03373vendor-advisory
- 1040630vdb-entry
- openSUSE-SU-2015:1139vendor-advisory
- 1034087vdb-entry
- 1033513vdb-entry
- 1032884vdb-entry
- RHSA-2015:1604vendor-advisory
- SUSE-SU-2016:0262vendor-advisory
- 1032932vdb-entry
- 1033891vdb-entry
- openSUSE-SU-2016:0226vendor-advisory
- 1032783vdb-entry
- 1032856vdb-entry
- NetBSD-SA2015-008vendor-advisory
- DSA-3300vendor-advisory
- USN-2656-2vendor-advisory
- 1033067vdb-entry
- 1033019vdb-entry
- RHSA-2015:1072vendor-advisory
- 1032650vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681
- http://www-01.ibm.com/support/docview.wss?uid=swg21962739
- https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923929
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10122
- http://support.apple.com/kb/HT204941
- http://www-304.ibm.com/support/docview.wss?uid=swg21962816
- http://www-01.ibm.com/support/docview.wss?uid=swg21959812
- https://www-304.ibm.com/support/docview.wss?uid=swg21959745
- https://weakdh.org/imperfect-forward-secrecy.pdf
- http://www-304.ibm.com/support/docview.wss?uid=swg21959132
- https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/
- http://www-01.ibm.com/support/docview.wss?uid=swg21959539
- https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/
- http://www-01.ibm.com/support/docview.wss?uid=swg21959325
- https://openssl.org/news/secadv/20150611.txt
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04740527
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_us
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190
- http://www-304.ibm.com/support/docview.wss?uid=swg21967893
- http://www-304.ibm.com/support/docview.wss?uid=swg21958984
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21959517
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21959195
- http://www-01.ibm.com/support/docview.wss?uid=swg21961717
- http://www-304.ibm.com/support/docview.wss?uid=swg21960041
- http://www-304.ibm.com/support/docview.wss?uid=swg21960194
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes
- http://www-01.ibm.com/support/docview.wss?uid=swg21959453
- https://security.netapp.com/advisory/ntap-20150619-0001/
- http://www-01.ibm.com/support/docview.wss?uid=swg21959111
- http://www-304.ibm.com/support/docview.wss?uid=swg21960418
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246
- https://www.suse.com/security/cve/CVE-2015-4000.html
- https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04953655
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128722
- http://support.citrix.com/article/CTX201114
- http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery
- http://www-304.ibm.com/support/docview.wss?uid=swg21960380
- http://support.apple.com/kb/HT204942
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193083
- http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241
- http://www-01.ibm.com/support/docview.wss?uid=swg21959530
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21960191
- http://www-01.ibm.com/support/docview.wss?uid=swg21959636
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04918839
- http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763
- https://puppet.com/security/cve/CVE-2015-4000
- http://www.mozilla.org/security/announce/2015/mfsa2015-70.html
- http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/releaseNotes.htm
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789
- https://support.citrix.com/article/CTX216642
- https://weakdh.org/
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119
- http://www-01.ibm.com/support/docview.wss?uid=swg21959481
- https://bto.bluecoat.com/security-advisory/sa98
- https://bugzilla.mozilla.org/show_bug.cgi?id=1138554
- http://www-01.ibm.com/support/docview.wss?uid=swg21962455
- https://www.openssl.org/news/secadv_20150611.txt
- http://www.fortiguard.com/advisory/2015-05-20-logjam-attack
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.