CVE-2015-2808
| Affected software | 4 products, listed below |
|---|---|
| Severity | 3.7 Low CVSS 3.1 2 scores |
| Weakness | CWE-327 |
| Published | 1 Apr 2015 |
| Updated | 17 Jun 2026 |
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Exploitation status
Forecast only (74% 30-day chance)
No exploit has been reported in the sources we check. EPSS puts this CVE in the top 0.52% of all scored CVEs. That is a model's forecast, not a report of exploitation.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 74% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
3.7 LOW
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
2 metrics
CVSS
3.7 LOW v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
CISA-ADP | Secondary | published |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2017 ↗ | CPU | 2017-Q4 | Oracle Fusion Middleware / Web Listener (11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0) |
| Oracle Critical Patch Update July 2016 ↗ | CPU | 2016-Q3 | Oracle Communications Applications / Security (Prior to 9.9.2) Oracle Sun Systems Products Suite / XCP Firmware (XCP prior to XCP1121) |
| Oracle Critical Patch Update July 2015 ↗ | CPU | 2015-Q3 | Oracle Java SE / Java SE, JRockit, Java SE Embedded (Java SE 6u95, Java SE 7u80, Java SE 8u45, JRockit R28.3.6, Java SE Embedded 7u75, Java SE Embedded 8u33) Oracle's note: Applies to client and server deployment of JSSE. |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Security | Prior to 9.9.2 | |
| Oracle Fusion Middleware | Web Listener | 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 | 11.1.1.7.0 · 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.1.0 · 12.2.1.2.0 |
| Oracle Java SE | Java SE, JRockit, Java SE Embedded | Java SE 6u95, Java SE 7u80, Java SE 8u45, JRockit R28.3.6, Java SE Embedded 7u75, Java SE Embedded 8u33 | 6.0.95.0 · 7.0.75.0 · 7.0.80.0 · 8.0.33.0 · 8.0.45.0 |
| Oracle Sun Systems Products Suite | XCP Firmware | XCP prior to XCP1121 |
Products and versions
61 products, 106 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | canonical | ubuntu linux | generic | 12.04 · 14.04 · 15.04 |
| nvd | debian | debian linux | generic | 7.0 · 8.0 |
| nvd | fujitsu | sparc enterprise m3000 firmware | generic | ＜ 1121 |
| nvd | fujitsu | sparc enterprise m4000 firmware | generic | ＜ 1121 |
| nvd | fujitsu | sparc enterprise m5000 firmware | generic | ＜ 1121 |
| nvd | fujitsu | sparc enterprise m8000 firmware | generic | ＜ 1121 |
| nvd | fujitsu | sparc enterprise m9000 firmware | generic | ＜ 1121 |
| nvd | huawei | 9700 firmware | generic | any version |
| nvd | huawei | e6000 firmware | generic | any version |
| nvd | huawei | e9000 firmware | generic | any version |
| nvd | huawei | oceanstor 18500 firmware | generic | any version |
| nvd | huawei | oceanstor 18800 firmware | generic | any version |
| nvd | huawei | oceanstor 18800f firmware | generic | any version |
| nvd | huawei | oceanstor 9000 firmware | generic | any version |
| nvd | huawei | oceanstor cse firmware | generic | any version |
| nvd | huawei | oceanstor hvs85t firmware | generic | any version |
| nvd | huawei | oceanstor replicationdirector | generic | v100r003c00 |
| nvd | huawei | oceanstor s2600t firmware | generic | any version |
| nvd | huawei | oceanstor s5500t firmware | generic | any version |
| nvd | huawei | oceanstor s5600t firmware | generic | any version |
| nvd | huawei | oceanstor s5800t firmware | generic | any version |
| nvd | huawei | oceanstor s6800t firmware | generic | any version |
| nvd | huawei | oceanstor vis6600t firmware | generic | any version |
| nvd | huawei | policy center | generic | v100r003c00 · v100r003c10 |
| nvd | huawei | quidway s9300 firmware | generic | any version |
| nvd | huawei | s12700 firmware | generic | any version |
| nvd | huawei | s2700 firmware | generic | any version |
| nvd | huawei | s2750 firmware | generic | any version |
| nvd | huawei | s3700 firmware | generic | any version |
| nvd | huawei | s5700ei firmware | generic | any version |
| nvd | huawei | s5700hi firmware | generic | any version |
| nvd | huawei | s5700li firmware | generic | any version |
| nvd | huawei | s5700s-li firmware | generic | any version |
| nvd | huawei | s5700si firmware | generic | any version |
| nvd | huawei | s5710ei firmware | generic | any version |
| nvd | huawei | s5710hi firmware | generic | any version |
| nvd | huawei | s5720ei firmware | generic | any version |
| nvd | huawei | s5720hi firmware | generic | any version |
| nvd | huawei | s6700 firmware | generic | any version |
| nvd | huawei | s7700 firmware | generic | any version |
| nvd | huawei | smc2.0 | generic | v100r002c01 · v100r002c02 · v100r002c03 · v100r002c04 |
| nvd | huawei | te60 firmware | generic | any version |
| nvd | huawei | ultravr | generic | v100r003c00 |
| nvd | ibm | cognos metrics manager | generic | 10.1 · 10.1.1 · 10.2 · 10.2.1 · 10.2.2 |
| nvd | opensuse | opensuse | generic | 13.1 · 13.2 |
| nvd | oracle | communications application session controller | generic | ≥ 3.0.0 and ≤ 3.9.0 |
| nvd | oracle | communications policy management | generic | ＜ 9.9.2 |
| nvd | oracle | http server | generic | 11.1.1.7.0 · 11.1.1.9.0 · 12.1.3.0.0 · 12.2.1.1.0 · 12.2.1.2.0 |
| nvd | oracle | integrated lights out manager firmware | generic | ≥ 3.0.0 and ≤ 3.2.11 · ≥ 4.0.0 and ≤ 4.0.4 |
| nvd | redhat | enterprise linux desktop | generic | 5.0 · 6.0 · 7.0 |
| nvd | redhat | enterprise linux eus | generic | 6.6 · 7.1 · 7.2 · 7.3 · 7.4 · 7.5 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux server | generic | 5.0 · 6.0 · 7.0 |
| nvd | redhat | enterprise linux server aus | generic | 6.6 · 7.3 · 7.4 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux server tus | generic | 7.3 · 7.6 · 7.7 |
| nvd | redhat | enterprise linux workstation | generic | 5.0 · 6.0 · 7.0 |
| nvd | redhat | satellite | generic | 5.6 · 5.7 |
| nvd | suse | linux enterprise debuginfo | generic | 11:sp3 · 11:sp4 |
| nvd | suse | linux enterprise desktop | generic | 11:sp3 · 11:sp4 · 12 |
| nvd | suse | linux enterprise server | generic | 10:sp4 · 11:sp1 · 11:sp2 · 11:sp3 · 12 |
| nvd | suse | linux enterprise software development kit | generic | 11:sp3 · 12 |
| nvd | suse | manager | generic | 1.7 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, SEE NOTE 4, WEB LISTENER, SSL/TLS, NO AUTH REMOTE EXPLOIT, JSSE, SECURITY, XCP FIRMWARE **Products:** JROCKIT, JAVA SE EMBEDDED, SSL/TLS, ORACLE HTTP SERVER, ORACLE FUSION MIDDLEWARE, ORACLE SUN SYSTEMS PRODUCTS SUITE, M5000, M8000, M4000, M9000 SERVERS, ORACLE COMMUNICATIONS APPLICATIONS, JAVA SE, ORACLE JAVA SE, ORACLE COMMUNICATIONS POLICY MANAGEMENT, SPARC ENTERPRISE M3000
References
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2015:1228 | ADVISORY, RHSA-2015:1228 |
| https://access.redhat.com/security/cve/CVE-2015-2808 | REPORT, RHSA-2015:1228 |
| https://access.redhat.com/errata/RHSA-2015:1229 | ADVISORY, RHSA-2015:1229 |
| https://access.redhat.com/errata/RHSA-2015:1230 | ADVISORY, RHSA-2015:1230 |
| https://access.redhat.com/errata/RHSA-2015:1241 | ADVISORY, RHSA-2015:1241 |
| https://access.redhat.com/errata/RHSA-2015:1526 | ADVISORY, RHSA-2015:1526 |
| http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034 | Third Party Advisory |
| http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 | Third Party Advisory |
| http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 | Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html | Mailing List, Third Party Advisory |
Timeline
Timeline
| Published | 2015-04-01 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |