Logjam Vulnerability (CVE-2015-4000)
Data de publicação: 14 agosto 2015
Identificador(es) CVE: : CVE-2015-4000
Data do informe: 14 agosto 2015
Descrição
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice. This allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, which could then result in an attacker being able to monitor encrypted communications by being able to decrypt them. This is known as the "Logjam" vulnerability.