GHSA-jcj6-c96p-jcmm · Severity: medium — The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state...
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Conclusion & alert: CVE-2015-2808 is rated Moderate Risk (48.9/100): CVSS Low severity, with high exploitation likelihood (EPSS 23.82%, 96th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-04 | 23.36% | 23.82% | +0.46% |
| 2 | 2026-05-29 | 21.39% | 23.36% | +1.96% |
| 3 | 2026-05-28 | — | 21.39% | — |
Full EPSS history (49 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 3.7 | 3.1 | LOW |
|
2.2 | 1.4 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
GHSA-jcj6-c96p-jcmm · Severity: medium — The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2015-2808 not yet assigned priority: Debian including 1 source packages (openjdk-8), 1 status rows across 1 suites (sid): resolved 1. | https://security-tracker.debian.org/tracker/CVE-2015-2808 |
gentoo
|
normal | CVE-2015-2808: 1 GLSA(s) (201512-10), 4 atom(s) (mail-client/thunderbird, mail-client/thunderbird-bin, www-client/firefox, www-client/firefox-bin); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2015-2808 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2015-2808 |
suse
|
high | CVE-2015-2808 severity important: SUSE including 230 source package names (java-1.6.0-openjdk-1.6.0.36-1.13.8.1.el7_1, java-1.6.0-openjdk-demo-1.6.0.36-1.13.8.1.el7_1, …), 533 product×package rows across 79 product lines (HPE Helion OpenStack 8, Image SLES12-SP5-Azure-SAP-BYOS, … (79 product lines)): Fixed 338, Known Not Affected 195. | https://www.suse.com/security/cve/CVE-2015-2808/ |
ubuntu
|
medium | CVE-2015-2808 medium priority: Ubuntu including 3 source packages (openjdk-6, openjdk-7, openjdk-8), 18 status rows across 6 suites (precise, trusty, upstream, utopic, vivid, wily): released 7, ignored 4, needs-triage 3, DNE 2, not-affected 2. | https://ubuntu.com/security/CVE-2015-2808 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| oracle | communications_application_session_controller | >= 3.0.0, <= 3.9.0 | cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:* |
| oracle | communications_policy_management | < 9.9.2 | cpe:2.3:a:oracle:communications_policy_management:*:*:*:*:*:*:*:* |
| oracle | http_server | 11.1.1.7.0 | cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:* |
| oracle | http_server | 11.1.1.9.0 | cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:* |
| oracle | http_server | 12.1.3.0.0 | cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:* |
| oracle | http_server | 12.2.1.1.0 | cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:* |
| oracle | http_server | 12.2.1.2.0 | cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:* |
| oracle | integrated_lights_out_manager_firmware | >= 3.0.0, <= 3.2.11 | cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* |
| oracle | integrated_lights_out_manager_firmware | >= 4.0.0, <= 4.0.4 | cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| debian | debian_linux | 8.0 | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| redhat | satellite | 5.7 | cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop | 5.0 | cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop | 6.0 | cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop | 7.0 | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 6.6 | cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 7.1 | cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 7.2 | cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 7.3 | cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 7.4 | cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 7.5 | cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 7.6 | cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 7.7 | cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server | 5.0 | cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server | 6.0 | cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server | 7.0 | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 6.6 | cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 7.3 | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 7.4 | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 7.6 | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 7.7 | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus | 7.3 | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus | 7.6 | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus | 7.7 | cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation | 5.0 | cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation | 6.0 | cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation | 7.0 | cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
| suse | linux_enterprise_debuginfo | 11 | cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:* |
| suse | linux_enterprise_debuginfo | 11 | cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:* |
| opensuse | opensuse | 13.1 | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
| opensuse | opensuse | 13.2 | cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
| suse | linux_enterprise_desktop | 11 | cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:* |
| suse | linux_enterprise_desktop | 11 | cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:* |
| suse | linux_enterprise_desktop | 12 | cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:* |
| suse | linux_enterprise_server | 10 | cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:* |
| suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:* |
| suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:* |
| suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:* |
| suse | linux_enterprise_server | 12 | cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* |
| suse | linux_enterprise_software_development_kit | 11 | cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:* |
| suse | linux_enterprise_software_development_kit | 12 | cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:* |
| suse | manager | 1.7 | cpe:2.3:a:suse:manager:1.7:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 12.04 | cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* |
| canonical | ubuntu_linux | 14.04 | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
| canonical | ubuntu_linux | 15.04 | cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* |
| redhat | satellite | 5.6 | cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:* |
| fujitsu | sparc_enterprise_m3000_firmware | >= xcp, < xcp_1121 | cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:* |
| fujitsu | sparc_enterprise_m4000_firmware | >= xcp, < xcp_1121 | cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:* |
| fujitsu | sparc_enterprise_m5000_firmware | >= xcp, < xcp_1121 | cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:* |
| fujitsu | sparc_enterprise_m8000_firmware | >= xcp, < xcp_1121 | cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:* |
| fujitsu | sparc_enterprise_m9000_firmware | >= xcp, < xcp_1121 | cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:* |
| huawei | e6000_firmware | — | cpe:2.3:o:huawei:e6000_firmware:-:*:*:*:*:*:*:* |
| huawei | e9000_firmware | — | cpe:2.3:o:huawei:e9000_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_18500_firmware | — | cpe:2.3:o:huawei:oceanstor_18500_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_18800_firmware | — | cpe:2.3:o:huawei:oceanstor_18800_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_18800f_firmware | — | cpe:2.3:o:huawei:oceanstor_18800f_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_9000_firmware | — | cpe:2.3:o:huawei:oceanstor_9000_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_cse_firmware | — | cpe:2.3:o:huawei:oceanstor_cse_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_hvs85t_firmware | — | cpe:2.3:o:huawei:oceanstor_hvs85t_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_s2600t_firmware | — | cpe:2.3:o:huawei:oceanstor_s2600t_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_s5500t_firmware | — | cpe:2.3:o:huawei:oceanstor_s5500t_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_s5600t_firmware | — | cpe:2.3:o:huawei:oceanstor_s5600t_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_s5800t_firmware | — | cpe:2.3:o:huawei:oceanstor_s5800t_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_s6800t_firmware | — | cpe:2.3:o:huawei:oceanstor_s6800t_firmware:-:*:*:*:*:*:*:* |
| huawei | oceanstor_vis6600t_firmware | — | cpe:2.3:o:huawei:oceanstor_vis6600t_firmware:-:*:*:*:*:*:*:* |
| huawei | quidway_s9300_firmware | — | cpe:2.3:o:huawei:quidway_s9300_firmware:-:*:*:*:*:*:*:* |
| huawei | s7700_firmware | — | cpe:2.3:o:huawei:s7700_firmware:-:*:*:*:*:*:*:* |
| huawei | 9700_firmware | — | cpe:2.3:o:huawei:9700_firmware:-:*:*:*:*:*:*:* |
| huawei | s12700_firmware | — | cpe:2.3:o:huawei:s12700_firmware:-:*:*:*:*:*:*:* |
| huawei | s2700_firmware | — | cpe:2.3:o:huawei:s2700_firmware:-:*:*:*:*:*:*:* |