CVE-2015-0285 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Openssl
Severity
4.3MEDIUMNVD
EPSS
8.5%
top 7.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 19
Latest updateDec 19
Description
The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.
CVSS vector
AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9
Affected Packages3 packages
Patches
🔴Vulnerability Details
1📋Vendor Advisories
18Debian▶
CVE-2015-0285: openssl - The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does ...↗2015