Description

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

Remediation

References

CVE-2010-4180

Related Vulnerabilities

WordPress Plugin Memphis Documents Library Multiple Unspecified Vulnerabilities (3.6.21)

WordPress Plugin Contact Form by BestWebSoft Cross-Site Scripting (3.95)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce SQL Injection (5.7.22)

Sqlite Integer Overflow or Wraparound Vulnerability (CVE-2015-3416)

WordPress Plugin Favicon by RealFaviconGenerator Cross-Site Scripting (1.2.12)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CVE-2010-4180