CVE-2015-2808
Lowopenjdk-6 - security update
Published Jun 10, 2022 · Updated May 29, 2026 · Also known as UBUNTU-CVE-2015-2808
Key Facts
Patch immediately- CVE-2015-2808 is a low-severity vulnerability (CVSS 3.7 v3.1) affecting Oceanstor Replicationdirector (Huawei), Policy Center (Huawei), Smc2.0 (Huawei) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 74% probability of exploitation in the next 30 days.
- Fixed versions are available, including Sparc Enterprise M3000 Firmware xcp_1121, Sparc Enterprise M4000 Firmware xcp_1121, Sparc Enterprise M5000 Firmware xcp_1121.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS (30-day exploit likelihood)
74%
Higher than 99.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2015-2808 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Affected Products
357 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Oceanstor ReplicationdirectorHuawei | v100r003c00 | n/a |
| Policy CenterHuawei | v100r003c00, v100r003c10 | n/a |
| Smc2.0Huawei | v100r002c01, v100r002c02, v100r002c03, v100r002c04 | n/a |
| UltravrHuawei | v100r003c00 | n/a |
| Cognos Metrics ManagerIbm | 10.1, 10.1.1, 10.2, 10.2.1, 10.2.2 | n/a |
Patched Releases
Sparc Enterprise M3000 Firmware
xcp_1121
Sparc Enterprise M4000 Firmware
xcp_1121
Sparc Enterprise M5000 Firmware
xcp_1121
Sparc Enterprise M8000 Firmware
xcp_1121
Sparc Enterprise M9000 Firmware
xcp_1121
gnutls
3.6.16-8.el8_9.3+sp999
java
1.6.0-openjdk-1:1.6.0.36-1.13.8.1.el7_1, 1.6.0-sun-1:1.6.0.101-1jpp.1.el5_11, 1.7.0-openjdk-1:1.7.0.85-2.6.1.2.ael7b_1, 1.8.0-openjdk-1:1.8.0.51-0.b16.el6_6
java-1_6_0-ibm
1.6.0_sr15.0-0.5.1, 1.6.0_sr16.15-27.1, 1.6.0_sr16.15-46.1, 1.6.0_sr16.2-0.3.1, 1.6.0_sr16.4-15.1, 1.6.0_sr16.7-10.1, 1.6.0_sr16.7-22.2
java-1_6_0-ibm-alsa
1.6.0_sr15.0-0.5.1, 1.6.0_sr16.0-0.3.1, 1.6.0_sr16.15-46.1, 1.6.0_sr16.2-0.3.1, 1.6.0_sr16.7-10.1
java-1_6_0-ibm-devel
1.6.0_sr16.0-0.3.1, 1.6.0_sr16.15-46.1, 1.6.0_sr16.2-0.3.1, 1.6.0_sr16.7-10.1
java-1_6_0-ibm-fonts
1.6.0_sr15.0-0.5.1, 1.6.0_sr16.15-27.1, 1.6.0_sr16.15-46.1, 1.6.0_sr16.2-0.3.1, 1.6.0_sr16.4-15.1, 1.6.0_sr16.7-10.1, 1.6.0_sr16.7-22.2
java-1_6_0-ibm-jdbc
1.6.0_sr15.0-0.5.1, 1.6.0_sr16.15-27.1, 1.6.0_sr16.15-46.1, 1.6.0_sr16.2-0.3.1, 1.6.0_sr16.4-15.1, 1.6.0_sr16.7-10.1, 1.6.0_sr16.7-22.2
java-1_6_0-ibm-plugin
1.6.0_sr15.0-0.5.1, 1.6.0_sr16.15-27.1, 1.6.0_sr16.15-46.1, 1.6.0_sr16.2-0.3.1, 1.6.0_sr16.4-15.1, 1.6.0_sr16.7-10.1, 1.6.0_sr16.7-22.2
java-1_7_0-ibm
1.7.0_sr6.0-0.7.1, 1.7.0_sr8.0-0.5.1, 1.7.0_sr9.10-9.1
java-1_7_0-ibm-alsa
1.7.0_sr6.0-0.7.1, 1.7.0_sr8.0-0.5.1, 1.7.0_sr9.10-9.1
java-1_7_0-ibm-devel
1.7.0_sr7.0-0.5.1, 1.7.0_sr8.0-0.5.1, 1.7.0_sr9.10-9.1
java-1_7_0-ibm-jdbc
1.7.0_sr6.0-0.7.1, 1.7.0_sr8.0-0.5.1, 1.7.0_sr9.10-9.1
java-1_7_0-ibm-plugin
1.7.0_sr6.0-0.7.1, 1.7.0_sr8.0-0.5.1, 1.7.0_sr9.10-9.1
java-1_7_0-openjdk
1.7.0.121-1.1, 1.7.0.85-0.11.2, 1.7.0.85-18.2
java-1_7_0-openjdk-accessibility
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap-devel
1.7.0.121-1.1
java-1_7_0-openjdk-bootstrap-headless
1.7.0.121-1.1
java-1_7_0-openjdk-demo
1.7.0.121-1.1, 1.7.0.85-0.11.2, 1.7.0.85-18.2
java-1_7_0-openjdk-devel
1.7.0.121-1.1, 1.7.0.85-0.11.2, 1.7.0.85-18.2
Timeline
Publicly disclosed
Jun 10, 2022
Last updated
May 29, 2026
Weakness Type
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
References
- advisoryhttp://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034
- advisoryhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- advisoryhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727
- advisorySUSE-SU-2015:1073
- advisorySUSE-SU-2015:1085
FAQ
Common Questions.
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relie…
Affected: Oceanstor Replicationdirector (Huawei) versions v100r003c00; Policy Center (Huawei) versions v100r003c00, v100r003c10; Smc2.0 (Huawei) versions v100r002c01, v100r002c02, v100r002c03, v100r002c04, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Sparc Enterprise M3000 Firmware xcp_1121, Sparc Enterprise M4000 Firmware xcp_1121, Sparc Enterprise M5000 Firmware xcp_1121.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2015-2808 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo