UpHeron
All vulnerabilities

Servers and applications

CVE-2015-4000

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

Severity
Low 3.7
Published
21 May 2015
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • Every version up to 1.0.1m
  • From 1.0.1 up to 1.0.1m
  • From 1.0.2 up to 1.0.2a
JavaServers and applications · cpe:a:oracle:jdk
  • Version 1.6.0-update95
  • Version 1.7.0-update75
  • Version 1.7.0-update80
  • Version 1.8.0-update_33
  • Version 1.8.0-update45
JavaServers and applications · cpe:a:oracle:jre
  • Version 1.6.0-update_95
  • Version 1.7.0-update_75
  • Version 1.7.0-update_80
  • Version 1.8.0-update_33
  • Version 1.8.0-update_45

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-4000
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-4000