CVE-2015-3152
MEDIUM
5.9
CVSS Score
Published: May 16, 2016 at 10:00 AM UTC
Updated: June 17, 2026 at 12:25 AM UTC
12 products affected across 6 vendorsDebian LinuxFedoraEnterprise Linux Desktop
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.9
Exploit prediction
EPSS 7%
Description
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Debian Linux· Debiandrupal
95%10.0.0 ≤ v < 10.0.205.5.0 ≤ v < 5.5.44
Affected range stops below 10.0.20, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.5.44, so it looks safe — our inference, not a vendor statement
v ≤ 6.1.2
95%
v ≤ 5.7.2
5.4.0 ≤ v < 5.4.435.5.0 ≤ v < 5.5.275.6.0 ≤ v < 5.6.11
Affected range stops below 5.4.43, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.5.27, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.6.11, so it looks safe — our inference, not a vendor statement
95%
Enterprise Linux Server· Red Hatrubygems
95%Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161436.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161625.html
- http://rhn.redhat.com/errata/RHSA-2015-1646.html
- http://rhn.redhat.com/errata/RHSA-2015-1647.html
- http://rhn.redhat.com/errata/RHSA-2015-1665.html
References (17)
Vendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161436.htmlVendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161625.htmlx_refsource_MISCExploitThird Party Advisory
Source: [email protected]
http://mysqlblog.fivefarmers.com/2014/04/02/redefining-ssl-option/x_refsource_CONFIRMThird Party Advisory
Source: [email protected]
http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory/x_refsource_MISCThird Party AdvisoryVDB Entry
Source: [email protected]
http://packetstormsecurity.com/files/131688/MySQL-SSL-TLS-Downgrade.htmlVendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
http://rhn.redhat.com/errata/RHSA-2015-1646.htmlVendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
http://rhn.redhat.com/errata/RHSA-2015-1647.htmlVendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
http://rhn.redhat.com/errata/RHSA-2015-1665.htmlCVSS
- Attack Vector
- NETWORK
- Complexity
- HIGH
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- HIGH
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-295
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card