Vulnerability Bulletins |
IBM Security Bulletin: FREAK vulnerability in TLS/SSL affects IBM CICS Transaction Gateway (CVE-2015-0204) |
|
| Affected software | IBM |
|
A vulnerability in the OpenSSL ssl3_get_key_exchange function could allow a remote downgrade the security of certain TLS connections. An OpenSSL client accepts the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using a man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers. This vulnerability is also know as the FREAK attack. CVE(s): CVE-2015-0204 Affected More info: https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_freak_vulnerability_in_tls_ssl_affects_ibm_cics_transaction_gateway_cve_2015_0204?lang=en_us |
|