SB2012062003 - Cryptographic issues in OpenSSL
Published: June 20, 2012 Updated: August 11, 2020
Security Bulletin ID
SB2012062003
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Cryptographic issues (CVE-ID: CVE-2011-5095)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-1923.
Remediation
Install update from vendor's website.