7.5

CVE-2002-20001

Exploit

EPSS 23.06%
Veröffentlicht 11.11.2021 19:15:07
Zuletzt bearbeitet 23.09.2026 13:10:00
Erkennungen
Login

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 16

NVD 64 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Balasys ≫ Dheater Version -

Siemens ≫ Scalance W1750d Firmware

Siemens ≫ Scalance W1750d Version -

Suse ≫ Linux Enterprise Server Version 11 Update -

Suse ≫ Linux Enterprise Server Version 12 Update -

Suse ≫ Linux Enterprise Server Version 15

F5 ≫ Big-ip Access Policy Manager Version >= 13.1.0 < 16.1.4

F5 ≫ Big-ip Access Policy Manager Version >= 17.0.0 < 17.1.0

F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Advanced Firewall Manager Version 17.5.0

F5 ≫ Big-ip Advanced Web Application Firewall Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Advanced Web Application Firewall Version 17.5.0

F5 ≫ Big-ip Analytics Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Analytics Version 17.5.0

F5 ≫ Big-ip Application Acceleration Manager Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Application Acceleration Manager Version 17.5.0

F5 ≫ Big-ip Application Security Manager Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Application Security Manager Version 17.5.0

F5 ≫ Big-ip Application Visibility And Reporting Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Application Visibility And Reporting Version 17.5.0

F5 ≫ Big-ip Carrier-grade Nat Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Carrier-grade Nat Version 17.5.0

F5 ≫ Big-ip Ddos Hybrid Defender Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Ddos Hybrid Defender Version 17.5.0

F5 ≫ Big-ip Domain Name System Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Domain Name System Version 17.5.0

F5 ≫ Big-ip Edge Gateway Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Edge Gateway Version 17.5.0

F5 ≫ Big-ip Fraud Protection Service Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Fraud Protection Service Version 17.5.0

F5 ≫ Big-ip Global Traffic Manager Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Global Traffic Manager Version 17.5.0

F5 ≫ Big-ip Link Controller Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Link Controller Version 17.5.0

F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Local Traffic Manager Version 17.5.0

F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Policy Enforcement Manager Version 17.5.0

F5 ≫ Big-ip Service Proxy Version 1.6.0 SwPlatform kubernetes

F5 ≫ Big-ip Ssl Orchestrator Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Ssl Orchestrator Version 17.5.0

F5 ≫ Big-ip Webaccelerator Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Webaccelerator Version 17.5.0

F5 ≫ Big-ip Websafe Version >= 13.1.0 <= 17.1.2

F5 ≫ Big-ip Websafe Version 17.5.0

F5 ≫ Big-iq Centralized Management Version >= 8.0.0 <= 8.4.0

F5 ≫ Big-iq Centralized Management Version 7.1.0

F5 ≫ Traffix Signaling Delivery Controller Version 5.1.0

F5 ≫ Traffix Signaling Delivery Controller Version 5.2.0

F5 ≫ F5os-a Version >= 1.3.0 <= 1.3.2

F5 ≫ F5os-a Version >= 1.5.0 <= 1.5.3

F5 ≫ F5os-a Version 1.8.0

F5 ≫ F5os-c Version >= 1.3.0 <= 1.3.2

F5 ≫ F5os-c Version >= 1.6.0 <= 1.6.2

F5 ≫ F5os-c Version 1.5.0

F5 ≫ F5os-c Version 1.5.1

F5 ≫ F5os-c Version 1.8.0

F5 ≫ F5os-c Version 1.8.1

Hpe ≫ Arubaos-cx Version >= 10.06.0000 < 10.06.0180

   Hpe ≫ Aruba Cx 4100i Version -
   Hpe ≫ Aruba Cx 6100 Version -
   Hpe ≫ Aruba Cx 6200f Version -
   Hpe ≫ Aruba Cx 6200m Version -
   Hpe ≫ Aruba Cx 6300f Version -
   Hpe ≫ Aruba Cx 6300m Version -
   Hpe ≫ Aruba Cx 6405 Version -
   Hpe ≫ Aruba Cx 6410 Version -
   Hpe ≫ Aruba Cx 8320 Version -
   Hpe ≫ Aruba Cx 8325-32c Version -
   Hpe ≫ Aruba Cx 8325-48y8c Version -
   Hpe ≫ Aruba Cx 8360-12c Version -
   Hpe ≫ Aruba Cx 8360-16y2c Version -
   Hpe ≫ Aruba Cx 8360-24xf2c Version -
   Hpe ≫ Aruba Cx 8360-32y4c Version -
   Hpe ≫ Aruba Cx 8360-48xt4c Version -
   Hpe ≫ Aruba Cx 8360-48y6c Version -
   Hpe ≫ Aruba Cx 8400 Version -

Hpe ≫ Arubaos-cx Version >= 10.07.0000 < 10.07.0030

   Hpe ≫ Aruba Cx 4100i Version -
   Hpe ≫ Aruba Cx 6100 Version -
   Hpe ≫ Aruba Cx 6200f Version -
   Hpe ≫ Aruba Cx 6200m Version -
   Hpe ≫ Aruba Cx 6300f Version -
   Hpe ≫ Aruba Cx 6300m Version -
   Hpe ≫ Aruba Cx 6405 Version -
   Hpe ≫ Aruba Cx 6410 Version -
   Hpe ≫ Aruba Cx 8320 Version -
   Hpe ≫ Aruba Cx 8325-32c Version -
   Hpe ≫ Aruba Cx 8325-48y8c Version -
   Hpe ≫ Aruba Cx 8360-12c Version -
   Hpe ≫ Aruba Cx 8360-16y2c Version -
   Hpe ≫ Aruba Cx 8360-24xf2c Version -
   Hpe ≫ Aruba Cx 8360-32y4c Version -
   Hpe ≫ Aruba Cx 8360-48xt4c Version -
   Hpe ≫ Aruba Cx 8360-48y6c Version -
   Hpe ≫ Aruba Cx 8400 Version -

Hpe ≫ Arubaos-cx Version >= 10.08.0000 < 10.08.0010

   Hpe ≫ Aruba Cx 4100i Version -
   Hpe ≫ Aruba Cx 6100 Version -
   Hpe ≫ Aruba Cx 6200f Version -
   Hpe ≫ Aruba Cx 6200m Version -
   Hpe ≫ Aruba Cx 6300f Version -
   Hpe ≫ Aruba Cx 6300m Version -
   Hpe ≫ Aruba Cx 6405 Version -
   Hpe ≫ Aruba Cx 6410 Version -
   Hpe ≫ Aruba Cx 8320 Version -
   Hpe ≫ Aruba Cx 8325-32c Version -
   Hpe ≫ Aruba Cx 8325-48y8c Version -
   Hpe ≫ Aruba Cx 8360-12c Version -
   Hpe ≫ Aruba Cx 8360-16y2c Version -
   Hpe ≫ Aruba Cx 8360-24xf2c Version -
   Hpe ≫ Aruba Cx 8360-32y4c Version -
   Hpe ≫ Aruba Cx 8360-48xt4c Version -
   Hpe ≫ Aruba Cx 8360-48y6c Version -
   Hpe ≫ Aruba Cx 8400 Version -

Hpe ≫ Arubaos-cx Version >= 10.09.0000 < 10.09.0002

   Hpe ≫ Aruba Cx 4100i Version -
   Hpe ≫ Aruba Cx 6100 Version -
   Hpe ≫ Aruba Cx 6200f Version -
   Hpe ≫ Aruba Cx 6200m Version -
   Hpe ≫ Aruba Cx 6300f Version -
   Hpe ≫ Aruba Cx 6300m Version -
   Hpe ≫ Aruba Cx 6405 Version -
   Hpe ≫ Aruba Cx 6410 Version -
   Hpe ≫ Aruba Cx 8320 Version -
   Hpe ≫ Aruba Cx 8325-32c Version -
   Hpe ≫ Aruba Cx 8325-48y8c Version -
   Hpe ≫ Aruba Cx 8360-12c Version -
   Hpe ≫ Aruba Cx 8360-16y2c Version -
   Hpe ≫ Aruba Cx 8360-24xf2c Version -
   Hpe ≫ Aruba Cx 8360-32y4c Version -
   Hpe ≫ Aruba Cx 8360-48xt4c Version -
   Hpe ≫ Aruba Cx 8360-48y6c Version -
   Hpe ≫ Aruba Cx 8400 Version -

Stormshield ≫ Stormshield Management Center Version < 3.3.3

Stormshield ≫ Stormshield Network Security Version >= 2.7.0 < 4.3.16

Stormshield ≫ Stormshield Network Security Version >= 4.4.0 < 4.6.3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	23.06%	0.975

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf

Third Party Advisory

https://dheatattack.com

Third Party Advisory

https://dheatattack.gitlab.io/

Third Party Advisory

https://github.com/mozilla/ssl-config-generator/issues/162

Issue Tracking

https://gitlab.com/dheatattack/dheater

Third Party Advisory

https://ieeexplore.ieee.org/document/10374117

Third Party Advisory

Technical Description

https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/

Third Party Advisory

https://www.reddit.com/r/netsec/comments/qdoosy/server_overload_by_enforcing_dhe_key_exchange/

Issue Tracking

https://www.suse.com/support/kb/doc/?id=000020510

Third Party Advisory

https://github.com/Balasys/dheater

Third Party Advisory

Product

https://support.f5.com/csp/article/K83120834

Third Party Advisory

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt

Third Party Advisory

Technical Description

https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol

Exploit

Technical Description

https://nvd.nist.gov/vuln/detail/CVE-2002-20001

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2002-20001

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2002-20001

EUVD