OpenSSL SSLv2 Cipher Vulnerability in Multiple Versions

CVE-2015-3197

Summary

The OpenSSL library, in versions 1.0.1 prior to 1.0.1r and 1.0.2 prior to 1.0.2f, allows the use of disabled SSLv2 ciphers. This flaw increases the risk of man-in-the-middle attacks, permitting attackers to compromise SSLv2 traffic and potentially decrypt transmitted data via computations on the affected protocols. Specific functions such as get_client_master_key and get_client_hello can be exploited, raising concerns about overall cryptographic security.

References