Description
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v) | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.1.0c-1 | — |
| Debian 13 | openssl | 1.1.0c-1 | — |
| Debian 12 | openssl | 1.1.0c-1 | — |
| Debian 9 | openssl1.0 | 1.0.2u-1~deb9u2 | DLA-2378-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.4 | USN-4504-1 |
| Ubuntu 16.04 LTS | openssl | 1.0.2g-1ubuntu4.17 | USN-4504-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS 16.04 LTS | openssl | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | openssl | 1.0.2g-1ubuntu4.fips.4.17.1 | — |
| Ubuntu Pro 16.04 LTS | edk2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27+esm10 | USN-7018-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | compat-openssl098 | 0.9.8j-106.21.1 | SUSE-SU-2020:2634-1 |
| SLES 11 SP4 | openssl | 0.9.8j-0.106.34.1 | SUSE-SU-2020:14491-1 |
| SLES 11 | openssl1 | 1.0.1g-0.58.27.2 | SUSE-SU-2020:14511-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | compat-openssl098 | 0.9.8j-106.21.1 | SUSE-SU-2020:2634-1 |
| SLES for SAP 12 SP4 | compat-openssl098 | 0.9.8j-106.21.1 | SUSE-SU-2020:2634-1 |
| SLES for SAP 12 SP3 | compat-openssl098 | 0.9.8j-106.21.1 | SUSE-SU-2020:2634-1 |
| SLES for SAP 12 SP2 | compat-openssl098 | 0.9.8j-106.21.1 | SUSE-SU-2020:2634-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssl | 0.9.8j-0.106.34.1 | SUSE-SU-2020:14491-1 |
Advisories 13
- USN-7018-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-4504-1 openssl, openssl1.0 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-2378-1 openssl1.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2020:14491-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:14511-1 Security update for openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1723 TLS: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 20, 2025
- SUSE-SU-2020:2634-1 Security update for compat-openssl098 SUSE / openSUSE Security Updates · May 2, 2025
- ICSA-22-242-02 Hitachi Energy Gateway Station (GWS) Product CISA ICS & IT advisories · Aug 30, 2022
- ICSA-22-242-01 Hitachi Energy FACTS Control Platform (FCP) Product CISA ICS & IT advisories · Aug 30, 2022
- ICSA-22-116-01 Hitachi Energy System Data Manager CISA ICS & IT advisories · Apr 26, 2022
- ICSA-22-111-03 Hitachi Energy MicroSCADA Pro/X SYS600 CISA ICS & IT advisories · Apr 21, 2022
- ICSA-21-336-08 Hitachi Energy RTU500 series CISA ICS & IT advisories · Dec 2, 2021
References
- https://www.openssl.org/news/secadv/20200909.txt
- USN-4504-1 vendor-advisory
- [debian-lts-announce] 20200925 [SECURITY] [DLA 2378-1] openssl1.0 security update mailing-list
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://security.netapp.com/advisory/ntap-20200911-0004/
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- GLSA-202210-02 vendor-advisory