CVE-2015-0285

Publication date 19 March 2015

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.

Read the notes from the security team

Status

Package Ubuntu Release Status
openssl 14.10 utopic
Not affected
14.04 LTS trusty
Not affected
12.04 LTS precise
Not affected
10.04 LTS lucid
Not affected
openssl098 14.10 utopic
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
10.04 LTS lucid Not in release

Notes

mdeslaur

1.0.2 only