Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2015-4000

Low

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by…

Published May 21, 2015 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2015-4000, DLA-507-1, DSA-3688-1, Logjam, SUSE-SU-2015:1482-1, SUSE-SU-2015:1526-1, SUSE-SU-2015:1544-1, SUSE-SU-2015:1581-1, SUSE-SU-2015:1695-1, SUSE-SU-2015:1840-1, SUSE-SU-2016:0224-1, SUSE-SU-2016:0262-1, SUSE-SU-2016:0344-1, SUSE-SU-2016:1618-1, SUSE-SU-2016:2209-1, SUSE-SU-2016:2385-1, SUSE-SU-2018:1768-1, SUSE-SU-2023:0586-1, SUSE-SU-2023:4506-1, SUSE-SU-2023:4507-1, UBUNTU-CVE-2015-4000

Key Facts

Patch immediately
  • CVE-2015-4000 is a low-severity vulnerability (CVSS 3.7 v3.1) affecting Safari (Apple), Chrome (Google), Content Manager (Ibm) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 100% probability of exploitation in the next 30 days.
  • Fixed versions are available, including apache2 2.4.10-14.10.1, apache2 2.4.23-4.1, apache2-devel 2.4.10-14.10.1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS (30-day exploit likelihood)

100%

Higher than 99.9% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2015-4000 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

Affected Products

1,344 affected entries in total
ProductAffected versionsFixed in
SafariAppleSee advisoryn/a
ChromeGoogleSee advisoryn/a
Content ManagerIbm8.5n/a
Internet ExplorerMicrosoftSee advisoryn/a
FirefoxMozilla38.1.0, 39.039.0+build5-0ubuntu0.14.04.1
20 more affected products in the full CVE brief

Patched Releases

apache2

2.4.10-14.10.1, 2.4.23-4.1

apache2-devel

2.4.10-14.10.1, 2.4.23-4.1

apache2-doc

2.4.10-14.10.1, 2.4.23-4.1

apache2-event

2.4.23-4.1

apache2-example-pages

2.4.10-14.10.1, 2.4.23-4.1

apache2-mod_auth_kerb

5.4-2.4.1

apache2-mod_fastcgi

2.4.7-3.4.1

apache2-mod_jk

1.2.40-2.6.1

apache2-mod_security2

2.8.0-3.4.1

apache2-prefork

2.4.10-14.10.1, 2.4.23-4.1

apache2-utils

2.4.10-14.10.1, 2.4.23-4.1

apache2-worker

2.4.10-14.10.1, 2.4.23-4.1

Iphone OS

<=8.3

Mac OS X

<=10.10.3

compat-libldap-2_3-0

2.3.37-11.1, 2.3.37-18.13.4, 2.3.37-2.35.1, 2.3.37-8.9.1

compat-libldap-2_3-0-debuginfo

2.3.37-8.9.1

compat-openssl097g

0.9.7g-146.22.1, 0.9.7g-146.22.31.1

compat-openssl097g-32bit

0.9.7g-146.22.1, 0.9.7g-146.22.31.1

compat-openssl098

0.9.8j-78.1

Firefox

39.0+build5-0ubuntu0.14.04.1

Firefox Esr

128.5.1-1.1

firefox-esr-branding-upstream

128.5.1-1.1

firefox-esr-translations-common

128.5.1-1.1

firefox-esr-translations-other

128.5.1-1.1

firefox-gcc47

4.7.2_20130108-0.37.2

Timeline

  1. Publicly disclosed

    May 21, 2015

  2. Last updated

    Aug 4, 2026

Weakness Type

  • CWE-295 Improper Certificate Validation
  • CWE-310
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2015-4000 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo