| Package | Affected versions | Patched versions |
|---|---|---|
| content manager | = 8.5 | |
| firefox | = 38.1.0= 39.0 | |
| firefox esr | = 31.8 | |
| network security services | = 3.19 | |
| seamonkey | = 2.35 | |
| thunderbird | = 31.8= 38.1 | |
| openssl | ≥ 1.0.1, ≤ 1.0.1m≥ 1.0.2, ≤ 1.0.2a≤ 1.0.1m | |
| jdk | = 1.6.0= 1.7.0= 1.8.0 | |
| jre | = 1.6.0= 1.7.0= 1.8.0 | |
| jrockit | = r28.3.6 | |
| sparc-opl service processor | ≤ 1121 |
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free