Maple Labs

CVE search · CVE-2015-8960

CVE-2015-8960

high 8.1

The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
secalert@redhat.com
Weakness
CWE-295

Severity

VersionScoreVectorSource
CVSS 3.1 high 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 2.0 medium 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • ietf · transport_layer_security
  • netapp · clustered_data_ontap_antivirus_connector
  • netapp · data_ontap_edge
  • netapp · host_agent
  • netapp · oncommand_shift
  • netapp · plug-in_for_symantec_netbackup
  • netapp · smi-s_provider
  • netapp · snap_creator_framework
  • netapp · snapdrive
  • netapp · snapmanager
  • netapp · snapprotect
  • netapp · solidfire_&_hci_management_node
  • netapp · system_setup

References