CVE-2020-1968 OpenSSL
| Affected software | OpenSSL |
|---|---|
| Severity | 3.7 Low CVSS 3.1 3 scores |
| Weakness | CWE-203 |
| Published | 9 Sep 2020 |
| Updated | 17 Jun 2026 |
Description
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 6 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 4.9% chance in 30 days
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
3.7 LOW
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
3 metrics
CVSS
3.7 LOW v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
NVD | Primary | published |
| CVSS 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
CISA-ADP | Secondary | |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Systems / Firmware (OpenSSL) (1.2.2) Oracle Systems / Firmware (OpenSSL) (1.3.1) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Systems / Firmware (OpenSSL) (2.0.0.14) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle PeopleSoft / Security (OpenSSL) (8.56, 8.57, 8.58) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle PeopleSoft | Security (OpenSSL) | 8.56, 8.57, 8.58 | 8.56 · 8.57 · 8.58 |
| Oracle Systems | Firmware (OpenSSL) | 1.2.2 | 1.2.2 · 1.3.1 · 2.0.0.14 |
Products and versions
15 products, 24 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | canonical | ubuntu linux | generic | 16.04 · 18.04 |
| nvd | debian | debian linux | generic | 9.0 |
| nvd | fujitsu | m10-1 firmware | generic | ＜ 2400 · ＜ 3100 |
| nvd | fujitsu | m10-4 firmware | generic | ＜ 2400 · ＜ 3100 |
| nvd | fujitsu | m10-4s firmware | generic | ＜ 2400 · ＜ 3100 |
| nvd | fujitsu | m12-1 firmware | generic | ＜ 2400 · ＜ 3100 |
| nvd | fujitsu | m12-2 firmware | generic | ＜ 2400 · ＜ 3100 |
| nvd | fujitsu | m12-2s firmware | generic | ＜ 2400 · ＜ 3100 |
| nvd | openssl | openssl | generic | ≥ 1.0.2 and ≤ 1.0.2 |
| nvd | oracle | ethernet switch es1-24 firmware | generic | 1.3.1 |
| nvd | oracle | ethernet switch es2-64 firmware | generic | 2.0.0.14 |
| nvd | oracle | ethernet switch es2-72 firmware | generic | 2.0.0.14 |
| nvd | oracle | ethernet switch tor-72 firmware | generic | 1.2.2 |
| nvd | oracle | jd edwards world security | generic | a9.4 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.56 · 8.57 · 8.58 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** SECURITY (OPENSSL), HTTPS, NO AUTH REMOTE EXPLOIT, FIRMWARE (OPENSSL) **Products:** ORACLE PEOPLESOFT, PEOPLESOFT ENTERPRISE PEOPLETOOLS, OPENSSL, ORACLE SYSTEMS, ORACLE ETHERNET SWITCH ES2-64, ORACLE ETHERNET SWITCH ES2-72
References
| URL | Tags |
|---|---|
| https://lists.debian.org/debian-lts-announce/2020/09/msg00016.html | Mailing List, Third Party Advisory |
| https://security.gentoo.org/glsa/202210-02 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20200911-0004/ | Third Party Advisory |
| https://usn.ubuntu.com/4504-1/ | Third Party Advisory |
| https://www.openssl.org/news/secadv/20200909.txt | Vendor Advisory |
| https://www.oracle.com//security-alerts/cpujul2021.html | Patch, Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuApr2021.html | Patch, Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Patch, Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujan2021.html | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuoct2021.html | Patch, Third Party Advisory |
Timeline
Timeline
| Published | 2020-09-09 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |