漏洞描述
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
security.gentoo.orghttps://security.gentoo.org/glsa/201506-02↗www.securitytracker.comhttp://www.securitytracker.com/id/1032651↗marc.infohttp://marc.info/?l=bugtraq&m=144043644216842&w=2↗ftp.netbsd.orghttp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc↗support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_us↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21961717↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21960194↗weakdh.orghttps://weakdh.org/imperfect-forward-secrecy.pdf↗cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf↗www.securitytracker.comhttp://www.securitytracker.com/id/1033067↗marc.infohttp://marc.info/?l=bugtraq&m=144050121701297&w=2↗www.securitytracker.comhttp://www.securitytracker.com/id/1033416↗www.securitytracker.comhttp://www.securitytracker.com/id/1033019↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1526.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1033513↗www.securitytracker.comhttp://www.securitytracker.com/id/1032649↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1033991↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1230.html↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1604.html↗www.ubuntu.comhttp://www.ubuntu.com/usn/USN-2673-1↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959636↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959812↗www.securitytracker.comhttp://www.securitytracker.com/id/1032648↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923929↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1544.html↗h20564.www2.hpe.comhttp://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html↗bto.bluecoat.comhttps://bto.bluecoat.com/security-advisory/sa98↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21960380↗www.securitytracker.comhttp://www.securitytracker.com/id/1032645↗www.securityfocus.comhttp://www.securityfocus.com/bid/74733↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21967893↗www.securitytracker.comhttp://www.securitytracker.com/id/1033760↗marc.infohttp://marc.info/?l=bugtraq&m=144060576831314&w=2↗lists.apple.comhttp://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html↗puppet.comhttps://puppet.com/security/cve/CVE-2015-4000↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1033065↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-1624.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032653↗www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html↗lists.fedoraproject.orghttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html↗security.netapp.comhttps://security.netapp.com/advisory/ntap-20150619-0001/↗www.debian.orghttp://www.debian.org/security/2015/dsa-3300↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2016-02/msg00097.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032783↗www.securitytracker.comhttp://www.securitytracker.com/id/1032865↗www.securitytracker.comhttp://www.securitytracker.com/id/1033210↗www.ubuntu.comhttp://www.ubuntu.com/usn/USN-2696-1↗www.securitytracker.comhttp://www.securitytracker.com/id/1033341↗www.securitytracker.comhttp://www.securitytracker.com/id/1032699↗www.debian.orghttp://www.debian.org/security/2015/dsa-3316↗www.debian.orghttp://www.debian.org/security/2015/dsa-3324↗www.securitytracker.comhttp://www.securitytracker.com/id/1032475↗www.securitytracker.comhttp://www.securitytracker.com/id/1033208↗kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html↗marc.infohttp://marc.info/?l=bugtraq&m=144060606031437&w=2↗www.securitytracker.comhttp://www.securitytracker.com/id/1032654↗h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04740527↗support.apple.comhttp://support.apple.com/kb/HT204941↗www.securitytracker.comhttp://www.securitytracker.com/id/1033430↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1243.html↗www.ubuntu.comhttp://www.ubuntu.com/usn/USN-2656-2↗www.securitytracker.comhttp://www.securitytracker.com/id/1034884↗marc.infohttp://marc.info/?l=bugtraq&m=145409266329539&w=2↗www.mozilla.orghttp://www.mozilla.org/security/announce/2015/mfsa2015-70.html↗security.gentoo.orghttps://security.gentoo.org/glsa/201603-11↗www.debian.orghttp://www.debian.org/security/2015/dsa-3339↗blog.cloudflare.comhttps://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959517↗support.apple.comhttp://support.apple.com/kb/HT204942↗www.securitytracker.comhttp://www.securitytracker.com/id/1032910↗www.securitytracker.comhttp://www.securitytracker.com/id/1034728↗www.ubuntu.comhttp://www.ubuntu.com/usn/USN-2656-1↗bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1138554↗kb.juniper.nethttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959195↗h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763↗developer.mozilla.orghttps://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes↗lists.fedoraproject.orghttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032652↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html↗lists.apple.comhttp://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1033385↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959539↗www.securitytracker.comhttp://www.securitytracker.com/id/1032656↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04918839↗lists.fedoraproject.orghttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032960↗www.securityfocus.comhttp://www.securityfocus.com/bid/91787↗h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193083↗marc.infohttp://marc.info/?l=bugtraq&m=143557934009303&w=2↗www.openssl.orghttps://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/↗www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032784↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1033064↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html↗www.debian.orghttp://www.debian.org/security/2015/dsa-3287↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1242.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html↗weakdh.orghttps://weakdh.org/↗www.suse.comhttps://www.suse.com/security/cve/CVE-2015-4000.html↗h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04953655↗www.securitytracker.comhttp://www.securitytracker.com/id/1032650↗www.securitytracker.comhttp://www.securitytracker.com/id/1032655↗www.securitytracker.comhttp://www.securitytracker.com/id/1032688↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21959132↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032727↗www.securitytracker.comhttp://www.securitytracker.com/id/1032759↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246↗kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10122↗help.ecostruxureit.comhttps://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes↗h20564.www2.hpe.comhttp://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402↗security.gentoo.orghttps://security.gentoo.org/glsa/201701-46↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html↗openwall.comhttp://openwall.com/lists/oss-security/2015/05/20/8↗www.securitytracker.comhttp://www.securitytracker.com/id/1033433↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1033222↗www.securitytracker.comhttp://www.securitytracker.com/id/1032856↗openssl.orghttps://openssl.org/news/secadv/20150611.txt↗www-304.ibm.comhttps://www-304.ibm.com/support/docview.wss?uid=swg21959745↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21962455↗www.securitytracker.comhttp://www.securitytracker.com/id/1032864↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21962739↗marc.infohttp://marc.info/?l=bugtraq&m=143880121627664&w=2↗www.securitytracker.comhttp://www.securitytracker.com/id/1032702↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959453↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html↗marc.infohttp://marc.info/?l=bugtraq&m=143558092609708&w=2↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html↗www.fortiguard.comhttp://www.fortiguard.com/advisory/2015-05-20-logjam-attack↗www.securitytracker.comhttp://www.securitytracker.com/id/1032778↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1185.html↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1488.html↗marc.infohttp://marc.info/?l=bugtraq&m=144104533800819&w=2↗support.citrix.comhttps://support.citrix.com/article/CTX216642↗www.openssl.orghttps://www.openssl.org/news/secadv_20150611.txt↗marc.infohttp://marc.info/?l=bugtraq&m=143655800220052&w=2↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1229.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1040630↗www.solarwinds.comhttp://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/releaseNotes.htm↗h20564.www2.hpe.comhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1485.html↗aix.software.ibm.comhttp://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc↗marc.infohttp://marc.info/?l=bugtraq&m=144061542602287&w=2↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1228.html↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1241.html↗fortiguard.comhttp://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21958984↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959325↗www.securitytracker.comhttp://www.securitytracker.com/id/1032871↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2016-02/msg00094.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959481↗www.ubuntu.comhttp://www.ubuntu.com/usn/USN-2706-1↗support.citrix.comhttp://support.citrix.com/article/CTX201114↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21960418↗www.securitytracker.comhttp://www.securitytracker.com/id/1032476↗security.gentoo.orghttps://security.gentoo.org/glsa/201512-10↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21960041↗www.securitytracker.comhttp://www.securitytracker.com/id/1032474↗www.securitytracker.comhttp://www.securitytracker.com/id/1032777↗www.securitytracker.comhttp://www.securitytracker.com/id/1036218↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html↗h20564.www2.hp.comhttps://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04718196↗marc.infohttp://marc.info/?l=bugtraq&m=143628304012255&w=2↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html↗www-304.ibm.comhttp://www-304.ibm.com/support/docview.wss?uid=swg21962816↗marc.infohttp://marc.info/?l=bugtraq&m=144493176821532&w=2↗www.securitytracker.comhttp://www.securitytracker.com/id/1034087↗marc.infohttp://marc.info/?l=bugtraq&m=143506486712441&w=2↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html↗marc.infohttp://marc.info/?l=bugtraq&m=143637549705650&w=2↗www.debian.orghttp://www.debian.org/security/2016/dsa-3688↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2015-07/msg00016.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959111↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1197.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032932↗www.securitytracker.comhttp://www.securitytracker.com/id/1033209↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1072.html↗marc.infohttp://marc.info/?l=bugtraq&m=144069189622016&w=2↗www.securitytracker.comhttp://www.securitytracker.com/id/1032884↗www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2021.html↗www-947.ibm.comhttps://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403↗www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html↗www.securitytracker.comhttp://www.securitytracker.com/id/1032637↗www.securitytracker.comhttp://www.securitytracker.com/id/1032647↗h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128722↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1486.html↗marc.infohttp://marc.info/?l=bugtraq&m=144102017024820&w=2↗www.securitytracker.comhttp://www.securitytracker.com/id/1033891↗rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-2056.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21960191↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html↗www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21959530↗