Oval Definition:	oval:com.ubuntu.xenial:def:20154000000
Revision Date: 2015-05-20 Version: 1 Title: CVE-2015-4000 on Ubuntu 16.04 LTS (xenial) - medium. Description: The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. Family: unix Class: vulnerability Status: Reference(s): CVE-2015-4000 Platform(s): Ubuntu 16.04 LTS Product(s): Definition Synopsis Ubuntu 16.04 LTS (xenial) is installed. AND Package Information NOT While related to the CVE in some way, the 'apache2' package in xenial is not affected. OR The 'firefox' package in xenial was vulnerable but has been fixed (note: '39.0+build5-0ubuntu1'). OR NOT While related to the CVE in some way, the 'gnutls28' package in xenial is not affected. OR The 'nss' package in xenial was vulnerable but has been fixed (note: '2:3.19.2-1ubuntu1'). OR NOT While related to the CVE in some way, the 'openjdk-8' package in xenial is not affected (note: '8u66-b17-1'). OR NOT While related to the CVE in some way, the 'openssl' package in xenial is not affected (note: '1.0.2a-1ubuntu1'). OR The 'thunderbird' package in xenial was vulnerable but has been fixed (note: '1:31.8.0+build1-0ubuntu1').
BACK