Severity
4.3MEDIUMNVD
EPSS
8.5%
top 7.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMar 19
Latest updateDec 19

Description

The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

Patches

🔴Vulnerability Details

1
GHSA
GHSA-8v72-7j9q-whx9: The ssl3_client_hello function in s3_clnt2022-05-14

📋Vendor Advisories

18
CISA ICS
Siemens SCALANCE X-200RNA Switch Devices2022-12-19
CISA ICS
Rockwell Automation Stratix 59002017-05-10
Cisco
Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products2015-03-20
Red Hat
openssl: handshake with unseeded PRNG2015-03-19
Debian
CVE-2015-0285: openssl - The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does ...2015

💬Community

1
Bugzilla
CVE-2015-0285 openssl: handshake with unseeded PRNG2015-03-16
CVE-2015-0285 — Openssl vulnerability | cvebase