CRSA-2015-0005.yaml

title: 'OpenDaylight LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks'

description: 'It was found that various TLS interfaces exposed by OpenDaylight were affected by the LOGJAM vulnerability. A man-in-the-middle attacker could use this flaw to perform a variety of attacks, potentially leading to the trivial decryption of ciphertext.'

references: 
  - https://weakdh.org/imperfect-forward-secrecy.pdf
  - https://wiki.opendaylight.org/view/Security_Advisories

affected-products:

  - product: CloudRouter
    version:
      - id: 1.0-beta
        component: opendaylight-helium
        issues:
          - 88
        patches:
          -  https://git.opendaylight.org/gerrit/#/c/22619
          -  https://git.opendaylight.org/gerrit/#/c/22261

vulnerabilities:

  - cve-id: CVE-2015-4000
    cloudrouter-security-issue: 5
    impact-assessment:
      source: 'IIX Product Security'
      rating: moderate
      assessment:
        type: CVSS2
        score: 4.3
        detail: AV:N/AC:M/Au:N/C:P/I:N/A:N
    classification:
      source: 'IIX Product Security'
      type: CWE
      detail: TODO

reporters:

  - name: 'Randy Randhawa'
    reported:
      - CVE-2015-4000