Skip to content
Fencer Intel
low 3.7

CVE-2015-2808 json

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initializati…

published 2015-04-01 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-2896

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
73.9%
EPSS 73.9% chance of exploitation in 30 days, percentile 99.4%
public exploits
0
none known

Summary

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Patch / fix

  • oracle communications_policy_management 9.9.2
  • fujitsu sparc_enterprise_m3000_firmware xcp_1121
  • fujitsu sparc_enterprise_m4000_firmware xcp_1121
  • fujitsu sparc_enterprise_m5000_firmware xcp_1121
  • fujitsu sparc_enterprise_m8000_firmware xcp_1121
  • fujitsu sparc_enterprise_m9000_firmware xcp_1121
  • openjdk-6 Ubuntu 14.04 LTS 6b36-1.13.8-0ubuntu1~14.04
  • openjdk-7 Ubuntu 14.04 LTS 7u79-2.5.6-0ubuntu1.14.04.1

ubuntu advisories UBUNTU-CVE-2015-2808

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • java-1.6.0-ibm RHEL 5 EXTRAS, network satellite 5.6 1:1.6.0.16.4-1jpp.1.el5
  • java-1.6.0-ibm RHEL 6 EXTRAS, network satellite 5.7, network satellite 5.6 1:1.6.0.16.4-1jpp.1.el6_6
  • java-1.6.0-ibm-src RHEL 5 EXTRAS 1:1.6.0.16.4-1jpp.1.el5
  • java-1.6.0-ibm-src RHEL 6 EXTRAS 1:1.6.0.16.4-1jpp.1.el6_6
  • java-1.6.0-ibm-demo RHEL 5 EXTRAS 1:1.6.0.16.4-1jpp.1.el5
  • java-1.6.0-ibm-demo RHEL 6 EXTRAS 1:1.6.0.16.4-1jpp.1.el6_6
  • java-1.6.0-ibm-jdbc RHEL 5 EXTRAS 1:1.6.0.16.4-1jpp.1.el5
  • java-1.6.0-ibm-jdbc RHEL 6 EXTRAS 1:1.6.0.16.4-1jpp.1.el6_6

red hat advisories RHSA-2015:1006RHSA-2015:1007RHSA-2015:1091RHSA-2015:1021RHSA-2015:1020RHSA-2015:1228

  • java-1_6_0-ibm SLE Module for Legacy 12 1.6.0_sr16.15-27.1
  • java-1_6_0-ibm SLES for SAP 11 SP3, SLES 11 SP3-TERADATA, SLES 11 SP3 +2 more 1.6.0_sr16.15-46.1
  • java-1_6_0-ibm SLES for SAP 11 SP3, SLES 11 SP3-TERADATA, SLES 11 SP3 +4 more 1.6.0_sr16.7-10.1
  • java-1_6_0-ibm SLE Module for Legacy 12 1.6.0_sr16.7-22.2
  • java-1_7_0-ibm SLES for SAP 11 SP3, SLES 11 SP3-TERADATA, SLES 11 SP3 +2 more 1.7.0_sr9.10-9.1
  • java-1_7_1-ibm SLES for SAP 12, SLES 12, SLE Software Development Kit 12 1.7.1_sr3.10-14.1
  • java-1_7_1-ibm SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 1.7.1_sr3.10-3.1
  • java-1_7_0-openjdk SLES for SAP 12, SLES 12, SLED 12 1.7.0.85-18.2

suse advisories SUSE-SU-2015:2192-1SUSE-SU-2015:2166-1SUSE-SU-2015:1509-1SUSE-SU-2015:1345-1SUSE-SU-2015:1375-1SUSE-SU-2015:1331-1

  • java-1_8_0-openjdk openSUSE Tumbleweed 1.8.0.111-1.1
  • java-1_7_0-openjdk openSUSE Tumbleweed 1.7.0.121-1.1

opensuse advisories openSUSE-SU-2024:10197-1openSUSE-SU-2024:10534-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-2808 updated cvss 4.3

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

  • Red Hat Enterprise Linux 5 nss, gnutls, openssl Red Hat Enterprise Linux 6 nss, gnutls, openssl, nss-tools, nss-sysinit, gnutls-guile, +2 more Red Hat Enterprise Linux 7 nss, gnutls, openssl, nss-tools, gnutls-c++, gnutls-dane, +4 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.6.0-sun 1.6.0.101-1jpp.1.el7_1, java-1.7.0-oracle 1.7.0.85-1jpp.2.el7_1, java-1.8.0-oracle 1.8.0.51-1jpp.2.el7_1, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el7_1, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Client 5 java-1.6.0-sun 1.6.0.101-1jpp.1.el5_11, java-1.7.0-oracle 1.7.0.85-1jpp.1.el5_11, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el5_11, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el5_11, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el5_11, java-1.7.0-oracle-src 1.7.0.85-1jpp.1.el5_11, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.6.0-sun 1.6.0.101-1jpp.1.el7_1, java-1.7.0-oracle 1.7.0.85-1jpp.2.el7_1, java-1.8.0-oracle 1.8.0.51-1jpp.2.el7_1, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el7_1, +5 more Red Hat Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.6.0-sun 1.6.0.101-1jpp.1.el6_6, java-1.7.0-oracle 1.7.0.85-1jpp.2.el6_6, java-1.8.0-oracle 1.8.0.51-1jpp.2.el6_6, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el6_6, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.6.0-sun 1.6.0.101-1jpp.1.el6_6, java-1.7.0-oracle 1.7.0.85-1jpp.2.el6_6, java-1.8.0-oracle 1.8.0.51-1jpp.2.el6_6, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el6_6, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.6.0-sun 1.6.0.101-1jpp.1.el7_1, java-1.7.0-oracle 1.7.0.85-1jpp.2.el7_1, java-1.8.0-oracle 1.8.0.51-1jpp.2.el7_1, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el7_1, +9 more
    +4 more products
    Red Hat Oracle Java for Red Hat Enterprise Linux Server 5 java-1.6.0-sun 1.6.0.101-1jpp.1.el5_11, java-1.7.0-oracle 1.7.0.85-1jpp.1.el5_11, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el5_11, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el5_11, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el5_11, java-1.7.0-oracle-src 1.7.0.85-1jpp.1.el5_11, +4 more Red Hat Oracle Java for Red Hat Enterprise Linux Server 6 java-1.6.0-sun 1.6.0.101-1jpp.1.el6_6, java-1.7.0-oracle 1.7.0.85-1jpp.2.el6_6, java-1.8.0-oracle 1.8.0.51-1jpp.2.el6_6, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el6_6, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.6.0-sun 1.6.0.101-1jpp.1.el7_1, java-1.7.0-oracle 1.7.0.85-1jpp.2.el7_1, java-1.8.0-oracle 1.8.0.51-1jpp.2.el7_1, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el7_1, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el7_1, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.6.0-sun 1.6.0.101-1jpp.1.el6_6, java-1.7.0-oracle 1.7.0.85-1jpp.2.el6_6, java-1.8.0-oracle 1.8.0.51-1jpp.2.el6_6, java-1.6.0-sun-src 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-demo 1.6.0.101-1jpp.1.el6_6, java-1.6.0-sun-jdbc 1.6.0.101-1jpp.1.el6_6, +9 more
    fixed: vendor fix RHSA-2015:1243
  • Red Hat Enterprise Linux (v. 5 server) java-1.7.0-openjdk 1.7.0.85-2.6.1.3.el5_11, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el5_11, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.3.el5_11, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el5_11, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.3.el5_11, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el5_11, +2 more Red Hat Enterprise Linux Client (v. 7) java-1.8.0-openjdk 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el7_1, java-1.8.0-openjdk-headless 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk-headless 1.7.0.85-2.6.1.2.el7_1 Red Hat Enterprise Linux Client Optional (v. 7) java-1.8.0-openjdk-src 1.8.0.51-1.b16.el7_1, java-1.8.0-openjdk-demo 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el7_1, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el7_1, +5 more
    fixed: vendor fix RHSA-2015:1526
  • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-demo 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-jdbc 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-plugin 1.7.1.3.0-1jpp.2.el7_1
    fixed: vendor fix RHSA-2015:1020
  • Red Hat Enterprise Linux ComputeNode (v. 7) java-1.8.0-openjdk 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el7_1, java-1.8.0-openjdk-headless 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk-headless 1.7.0.85-2.6.1.2.el7_1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) java-1.8.0-openjdk-src 1.8.0.51-1.b16.el7_1, java-1.8.0-openjdk-demo 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el7_1, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el7_1, +5 more
    fixed: vendor fix RHSA-2015:1526
  • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-demo 1.7.1.3.0-1jpp.2.el7_1
    fixed: vendor fix RHSA-2015:1020
  • Red Hat Enterprise Linux Desktop (v. 5 client) java-1.7.0-openjdk 1.7.0.85-2.6.1.3.el5_11, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el5_11, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.3.el5_11, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el5_11, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.3.el5_11, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el5_11, +2 more Red Hat Enterprise Linux Desktop (v. 6) java-1.8.0-openjdk 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el6_7, java-1.8.0-openjdk-headless 1.8.0.51-0.b16.el6_6 Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.8.0-openjdk-src 1.8.0.51-0.b16.el6_6, java-1.8.0-openjdk-demo 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el6_7, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el6_7, +3 more
    fixed: vendor fix RHSA-2015:1526
  • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.7.0-ibm 1.7.0.9.0-1jpp.1.el5, java-1.6.0-ibm 1.6.0.16.4-1jpp.1.el5, java-1.5.0-ibm 1.5.0.16.10-1jpp.1.el5, java-1.7.0-ibm-src 1.7.0.9.0-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.16.4-1jpp.1.el5, java-1.7.0-ibm-demo 1.7.0.9.0-1jpp.1.el5, +13 more Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm 1.6.0.16.4-1jpp.1.el6_6, java-1.5.0-ibm 1.5.0.16.10-1jpp.1.el6_6, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm-src 1.6.0.16.4-1jpp.1.el6_6, java-1.7.1-ibm-demo 1.7.1.3.0-1jpp.2.el6_6, +11 more
    fixed: vendor fix RHSA-2015:1021
show 7 more
  • Red Hat Enterprise Linux HPC Node (v. 6) java-1.8.0-openjdk 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el6_7, java-1.8.0-openjdk-headless 1.8.0.51-0.b16.el6_6 Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.8.0-openjdk-src 1.8.0.51-0.b16.el6_6, java-1.8.0-openjdk-demo 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el6_7, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el6_7, +3 more
    fixed: vendor fix RHSA-2015:1526
  • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm 1.6.0.16.4-1jpp.1.el6_6, java-1.5.0-ibm 1.5.0.16.10-1jpp.1.el6_6, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm-src 1.6.0.16.4-1jpp.1.el6_6, java-1.7.1-ibm-demo 1.7.1.3.0-1jpp.2.el6_6, +5 more
    fixed: vendor fix RHSA-2015:1021
  • Red Hat Enterprise Linux Server (v. 6) java-1.8.0-openjdk 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el6_7, java-1.8.0-openjdk-headless 1.8.0.51-0.b16.el6_6, java-1.6.0-openjdk-javadoc 1.6.0.36-1.13.8.1.el6_7 Red Hat Enterprise Linux Server (v. 7) java-1.8.0-openjdk 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk 1.7.0.85-2.6.1.2.el7_1, java-1.8.0-openjdk 1.8.0.51-1.b16.ael7b_1, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el7_1, java-1.7.0-openjdk 1.7.0.85-2.6.1.2.ael7b_1, java-1.8.0-openjdk-headless 1.8.0.51-1.b16.el7_1, +3 more Red Hat Enterprise Linux Server Optional (v. 6) java-1.8.0-openjdk-src 1.8.0.51-0.b16.el6_6, java-1.8.0-openjdk-demo 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el6_7, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el6_7, +2 more Red Hat Enterprise Linux Server Optional (v. 7) java-1.8.0-openjdk-src 1.8.0.51-1.b16.el7_1, java-1.8.0-openjdk-demo 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.2.el7_1, java-1.8.0-openjdk-src 1.8.0.51-1.b16.ael7b_1, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el7_1, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.2.el7_1, +13 more
    fixed: vendor fix RHSA-2015:1526
  • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.7.0-ibm 1.7.0.9.0-1jpp.1.el5, java-1.6.0-ibm 1.6.0.16.4-1jpp.1.el5, java-1.5.0-ibm 1.5.0.16.10-1jpp.1.el5, java-1.7.0-ibm-src 1.7.0.9.0-1jpp.1.el5, java-1.6.0-ibm-src 1.6.0.16.4-1jpp.1.el5, java-1.7.0-ibm-demo 1.7.0.9.0-1jpp.1.el5, +13 more Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm 1.6.0.16.4-1jpp.1.el6_6, java-1.5.0-ibm 1.5.0.16.10-1jpp.1.el6_6, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm-src 1.6.0.16.4-1jpp.1.el6_6, java-1.7.1-ibm-demo 1.7.1.3.0-1jpp.2.el6_6, +11 more
    fixed: vendor fix RHSA-2015:1021
  • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm 1.7.1.3.0-1jpp.2.ael7b_1, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-demo 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-jdbc 1.7.1.3.0-1jpp.2.el7_1, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.ael7b_1, +3 more
    fixed: vendor fix RHSA-2015:1020
  • Red Hat Enterprise Linux Workstation (v. 6) java-1.8.0-openjdk 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el6_7, java-1.8.0-openjdk-headless 1.8.0.51-0.b16.el6_6, java-1.6.0-openjdk-javadoc 1.6.0.36-1.13.8.1.el6_7 Red Hat Enterprise Linux Workstation (v. 7) java-1.8.0-openjdk 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk 1.6.0.36-1.13.8.1.el7_1, java-1.8.0-openjdk-headless 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk-headless 1.7.0.85-2.6.1.2.el7_1 Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.8.0-openjdk-src 1.8.0.51-0.b16.el6_6, java-1.8.0-openjdk-demo 1.8.0.51-0.b16.el6_6, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el6_7, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.3.el6_6, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el6_7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) java-1.8.0-openjdk-src 1.8.0.51-1.b16.el7_1, java-1.8.0-openjdk-demo 1.8.0.51-1.b16.el7_1, java-1.7.0-openjdk-src 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk-src 1.6.0.36-1.13.8.1.el7_1, java-1.7.0-openjdk-demo 1.7.0.85-2.6.1.2.el7_1, java-1.6.0-openjdk-demo 1.6.0.36-1.13.8.1.el7_1, +5 more
    fixed: vendor fix RHSA-2015:1526
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm 1.6.0.16.4-1jpp.1.el6_6, java-1.5.0-ibm 1.5.0.16.10-1jpp.1.el6_6, java-1.7.1-ibm-src 1.7.1.3.0-1jpp.2.el6_6, java-1.6.0-ibm-src 1.6.0.16.4-1jpp.1.el6_6, java-1.7.1-ibm-demo 1.7.1.3.0-1jpp.2.el6_6, +11 more
    fixed: vendor fix RHSA-2015:1021

4 more fixed in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-160-01 updated cvss 5.9

Mitsubishi Electric Air Conditioning Systems

  • Mitsubishi Electric AE-50A <= 7.97 Mitsubishi Electric AE-50E <= 7.97 Mitsubishi Electric AE-50J <= 7.97 Mitsubishi Electric AE-200A <= 7.97 Mitsubishi Electric AE-200E <= 7.97 Mitsubishi Electric AE-200J <= 7.97
    +14 more products
    Mitsubishi Electric AG-150A-A <= 3.21 Mitsubishi Electric AG-150A-J <= 3.21 Mitsubishi Electric EB-50GU-A <= 7.10 Mitsubishi Electric EB-50GU-J <= 7.10 Mitsubishi Electric EW-50A <= 7.97 Mitsubishi Electric EW-50E <= 7.97 Mitsubishi Electric EW-50J <= 7.97 Mitsubishi Electric G-150AD <= 3.21 Mitsubishi Electric GB-50AD <= 3.21 Mitsubishi Electric GB-50ADA-A <= 3.21 Mitsubishi Electric GB-50ADA-J <= 3.21 Mitsubishi Electric TE-50A <= 7.97 Mitsubishi Electric TE-200A <= 7.97 Mitsubishi Electric TW-50A <= 7.97
    affected: fixed in 7.98, mitigation “G-150AD: Replace the air conditioning systems to AE-200J, AE-50J or EW-50J Version 7.98 or later” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

73.85% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.