Description
OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.8k-1 | — |
| Debian 13 | openssl | 0.9.8k-1 | — |
| Debian 12 | openssl | 0.9.8k-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | openssl +2 | 0.9.8e-12.el5_5.7 | RHSA-2010:0978 |
| RHEL 4 | openssl +2 | 0.9.7a-43.17.el4_8.6 | RHSA-2010:0977 |
Advisories 2
- RHSA-2010:0977 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0978 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://cvs.openssl.org/chngview?cn=17489
- 42493 third-party-advisory
- SSRT100817 vendor-advisory
- USN-1029-1 vendor-advisory
- HPSBHF02706 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=659462
- 45254 vdb-entry
- RHSA-2010:0977 vendor-advisory
- RHSA-2010:0978 vendor-advisory
- RHSA-2011:0896 vendor-advisory