{
  "threat_severity" : "Moderate",
  "public_date" : "2016-01-06T00:00:00Z",
  "bugzilla" : {
    "description" : "TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)",
    "id" : "1289841",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1289841"
  },
  "cvss" : {
    "cvss_base_score" : "5.8",
    "cvss_scoring_vector" : "AV:N/AC:M/Au:N/C:P/I:P/A:N",
    "status" : "verified"
  },
  "details" : [ "Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.", "A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to impersonate a TLS server or an authenticated TLS client." ],
  "affected_release" : [ {
    "product_name" : "Oracle Java for Red Hat Enterprise Linux 5",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0056",
    "cpe" : "cpe:/a:redhat:rhel_extras_oracle_java:5",
    "package" : "java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el5_11"
  }, {
    "product_name" : "Oracle Java for Red Hat Enterprise Linux 6",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0055",
    "cpe" : "cpe:/a:redhat:rhel_extras_oracle_java:6",
    "package" : "java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el6_7"
  }, {
    "product_name" : "Oracle Java for Red Hat Enterprise Linux 6",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0056",
    "cpe" : "cpe:/a:redhat:rhel_extras_oracle_java:6",
    "package" : "java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el6_7"
  }, {
    "product_name" : "Oracle Java for Red Hat Enterprise Linux 7",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0055",
    "cpe" : "cpe:/a:redhat:rhel_extras_oracle_java:7",
    "package" : "java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el7"
  }, {
    "product_name" : "Oracle Java for Red Hat Enterprise Linux 7",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0056",
    "cpe" : "cpe:/a:redhat:rhel_extras_oracle_java:7",
    "package" : "java-1.7.0-oracle-1:1.7.0.95-1jpp.2.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0054",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5",
    "package" : "java-1.7.0-openjdk-1:1.7.0.95-2.6.4.1.el5_11"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0100",
    "cpe" : "cpe:/a:redhat:rhel_extras:5",
    "package" : "java-1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0101",
    "cpe" : "cpe:/a:redhat:rhel_extras:5",
    "package" : "java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2016-01-07T00:00:00Z",
    "advisory" : "RHSA-2016:0007",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "nss-0:3.19.1-8.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2016-01-08T00:00:00Z",
    "advisory" : "RHSA-2016:0008",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "openssl-0:1.0.1e-42.el6_7.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2016-01-08T00:00:00Z",
    "advisory" : "RHSA-2016:0012",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "gnutls-0:2.8.5-19.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2016-01-20T00:00:00Z",
    "advisory" : "RHSA-2016:0050",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "java-1.8.0-openjdk-1:1.8.0.71-1.b15.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0053",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "java-1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0099",
    "cpe" : "cpe:/a:redhat:rhel_extras:6",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0101",
    "cpe" : "cpe:/a:redhat:rhel_extras:6",
    "package" : "java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2016-01-07T00:00:00Z",
    "advisory" : "RHSA-2016:0007",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "nss-0:3.19.1-19.el7_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2016-01-08T00:00:00Z",
    "advisory" : "RHSA-2016:0008",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "openssl-1:1.0.1e-51.el7_2.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2016-01-08T00:00:00Z",
    "advisory" : "RHSA-2016:0012",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "gnutls-0:3.3.8-14.el7_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2016-01-20T00:00:00Z",
    "advisory" : "RHSA-2016:0049",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "java-1.8.0-openjdk-1:1.8.0.71-2.b15.el7_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2016-01-21T00:00:00Z",
    "advisory" : "RHSA-2016:0054",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "java-1.7.0-openjdk-1:1.7.0.95-2.6.4.0.el7_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0098",
    "cpe" : "cpe:/a:redhat:rhel_extras:7",
    "package" : "java-1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0099",
    "cpe" : "cpe:/a:redhat:rhel_extras:7",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7"
  }, {
    "product_name" : "Red Hat Satellite 5.6",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.6::el5",
    "package" : "java-1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5"
  }, {
    "product_name" : "Red Hat Satellite 5.6",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.6::el5",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7"
  }, {
    "product_name" : "Red Hat Satellite 5.6",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.6::el5",
    "package" : "spacewalk-java-0:2.0.2-109.el5sat"
  }, {
    "product_name" : "Red Hat Satellite 5.7",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.7::el6",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7"
  }, {
    "product_name" : "Red Hat Satellite 5.7",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.7::el6",
    "package" : "spacewalk-java-0:2.3.8-146.el6sat"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Not affected",
    "package_name" : "gnutls",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Not affected",
    "package_name" : "java-1.6.0-sun",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Not affected",
    "package_name" : "openssl",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Not affected",
    "package_name" : "openssl097a",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "java-1.6.0-sun",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "openssl098e",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "java-1.6.0-sun",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "openssl098e",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Not affected",
    "package_name" : "openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 1",
    "fix_state" : "Will not fix",
    "package_name" : "openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:1"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 2",
    "fix_state" : "Not affected",
    "package_name" : "openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:2"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Web Server 3",
    "fix_state" : "Affected",
    "package_name" : "openssl",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2015-7575\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-7575\nhttp://www.mitls.org/pages/attacks/SLOTH\nhttps://access.redhat.com/articles/2112261\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2015-150/" ],
  "name" : "CVE-2015-7575",
  "csaw" : false
}