{"cve_id":"CVE-2015-0204","published":"2015-01-09T02:59:10.287000+00:00","last_modified":"2026-10-14T22:17:01.677000+00:00","vuln_status":"Modified","description":"The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the \"FREAK\" issue.  NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.","cvss_version":"2.0","cvss_vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","base_score":4.3,"base_severity":"MEDIUM","attack_vector":"NETWORK","privileges_req":"","user_interaction":"NONE","scope":"","impact_c":"NONE","impact_i":"PARTIAL","impact_a":"NONE","cwe_ids":["CWE-310"],"in_kev":false,"kev_date_added":null,"kev_ransomware":false,"epss_score":0.98685,"epss_percentile":0.99924,"cap_rule_version":"0.1.1","stage":"IMPACT","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"NONE","caps":["TAMPER"],"terminal":true,"cap_confidence":"high","ingested_at":"2026-10-28T03:15:38.033295+00:00","first_seen":"2015-01-09T02:59:10.287000+00:00","kev_first_seen":null,"novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["openssl"],"products":["openssl"],"affected":[{"vendor":"openssl","product":"openssl","ranges":["≤ 0.9.8zc","1.0.0a","1.0.0b","1.0.0c","1.0.0d","1.0.0e","1.0.0f","1.0.0g","1.0.0h","1.0.0i","1.0.0j","1.0.0k","1.0.0l","1.0.0m","1.0.0n","1.0.0o","1.0.1a","1.0.1b","1.0.1c","1.0.1d","1.0.1e","1.0.1f","1.0.1g","1.0.1h","1.0.1i","1.0.1j"]}]}