CVE-2008-7270 - CVE House
Back to Database
Status published Medium CVE-2008-7270

OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent...

Vulnerability Description

OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-7270

Credits & Attribution

No credits recorded in the NVD database.

References

More from openssl

View All →
CVE-2016-7055
There is a carry propagating bug in the Broadwell-specific Montgomery...
Medium 5.9
CVE-2016-6309
statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after...
Critical 9.8
CVE-2016-6308
statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a...
Medium 5.9
CVE-2016-6307
The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory...
Medium 5.9
CVE-2016-6306
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before...
Medium 5.9

Affected Vendor

Affected Software

openssl
Vulnerable Versions:
0, 0.9.1c, 0.9.2b, 0.9.3, 0.9.3a, 0.9.4, 0.9.5, 0.9.5a, 0.9.6, 0.9.6a, 0.9.6b, 0.9.6c, 0.9.6d, 0.9.6e, 0.9.6f, 0.9.6g, 0.9.6h, 0.9.6i, 0.9.6j, 0.9.6k, 0.9.6l, 0.9.6m, 0.9.7, 0.9.7a, 0.9.7b, 0.9.7c, 0.9.7d, 0.9.7e, 0.9.7f, 0.9.7g, 0.9.7h, 0.9.7i, 0.9.7j, 0.9.7k, 0.9.7l, 0.9.7m, 0.9.8, 0.9.8a, 0.9.8b, 0.9.8c, 0.9.8d, 0.9.8e, 0.9.8f, 0.9.8g, 0.9.8h

Timeline

Official Publish: December 6th, 2010
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.