Lucene search

[email protected]NVD:CVE-2002-20001

HistoryNov 11, 2021 - 7:15 p.m.

CVE-2002-20001

2021-11-1119:15:07

CWE-400

[email protected]

web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.011 Low

EPSS

Percentile

84.3%

JSON

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

Affected configurations

NVD

Node

balasysdheaterMatch-

Node

siemensscalance_w1750d_firmware

AND

siemensscalance_w1750dMatch-

Node

suselinux_enterprise_serverMatch11-

suselinux_enterprise_serverMatch12-

suselinux_enterprise_serverMatch15

Node

f5big-ip_access_policy_managerRange13.1.0–17.1.0

f5big-ip_advanced_firewall_managerRange13.1.0–17.1.0

f5big-ip_advanced_web_application_firewallRange13.1.0–17.1.0

f5big-ip_analyticsRange13.1.0–17.1.0

f5big-ip_application_acceleration_managerRange13.1.0–17.1.0

f5big-ip_application_security_managerRange13.1.0–17.1.0

f5big-ip_application_visibility_and_reportingRange13.1.0–17.1.0

f5big-ip_carrier-grade_natRange13.1.0–17.1.0

f5big-ip_ddos_hybrid_defenderRange13.1.0–17.1.0

f5big-ip_domain_name_systemRange13.1.0–17.1.0

f5big-ip_edge_gatewayRange13.1.0–17.1.0

f5big-ip_fraud_protection_serviceRange13.1.0–17.1.0

f5big-ip_global_traffic_managerRange13.1.0–17.1.0

f5big-ip_link_controllerRange13.1.0–17.1.0

f5big-ip_local_traffic_managerRange13.1.0–17.1.0

f5big-ip_policy_enforcement_managerRange13.1.0–17.1.0

f5big-ip_service_proxyMatch1.6.0kubernetes

f5big-ip_ssl_orchestratorRange13.1.0–17.1.0

f5big-ip_webacceleratorRange13.1.0–17.1.0

f5big-ip_websafeRange13.1.0–17.1.0

f5big-iq_centralized_managementRange8.0.0–8.2.0

f5big-iq_centralized_managementMatch7.1.0

f5f5os-aMatch1.3.0

f5f5os-aMatch1.3.1

f5f5os-cRange1.3.0–1.3.2

f5f5os-cMatch1.5.0

f5f5os-cMatch1.5.1

f5traffix_signaling_delivery_controllerMatch5.1.0

f5traffix_signaling_delivery_controllerMatch5.2.0

Node

hpearubaos-cxRange10.06.0000–10.06.0180

hpearubaos-cxRange10.07.0000–10.07.0030

hpearubaos-cxRange10.08.0000–10.08.0010

hpearubaos-cxRange10.09.0000–10.09.0002

AND

hpearuba_cx_4100iMatch-

hpearuba_cx_6100Match-

hpearuba_cx_6200fMatch-

hpearuba_cx_6200mMatch-

hpearuba_cx_6300fMatch-

hpearuba_cx_6300mMatch-

hpearuba_cx_6405Match-

hpearuba_cx_6410Match-

hpearuba_cx_8320Match-

hpearuba_cx_8325-32cMatch-

hpearuba_cx_8325-48y8cMatch-

hpearuba_cx_8360-12cMatch-

hpearuba_cx_8360-16y2cMatch-

hpearuba_cx_8360-24xf2cMatch-

hpearuba_cx_8360-32y4cMatch-

hpearuba_cx_8360-48xt4cMatch-

hpearuba_cx_8360-48y6cMatch-

hpearuba_cx_8400Match-

Node

stormshieldstormshield_management_centerRange<3.3.3

stormshieldstormshield_network_securityRange2.7.0–4.3.16

stormshieldstormshield_network_securityRange4.4.0–4.6.3

References

cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf

dheatattack.com

dheatattack.gitlab.io/

github.com/Balasys/dheater

github.com/mozilla/ssl-config-generator/issues/162

gitlab.com/dheatattack/dheater

ieeexplore.ieee.org/document/10374117

support.f5.com/csp/article/K83120834

www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt

www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/

www.reddit.com/r/netsec/comments/qdoosy/server_overload_by_enforcing_dhe_key_exchange/

www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol

www.suse.com/support/kb/doc/?id=000020510

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.011 Low

EPSS

Percentile

84.3%

JSON

Related for NVD:CVE-2002-20001

cve2 cvelist2 openvas3 nessus3 nvd1 prion1 ubuntucve1 f51 avleonov1 ics1