PatchTheCVECVE-2015-3197: ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers,
55
This week
MEDIUM 5.9REMOTEWATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE
CVE-2015-3197 is a medium-severity flaw (CVSS 5.9) affecting tuxedo, exalogic infrastructure, peoplesoft enterprise peopletools. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
Why this priority
- EPSS top 4%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
oracle tuxedo DOWNGRADE
Affected: 12.1.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 12.1.1.0
1. Check installed version
apt-cache policy tuxedo || rpm -q tuxedo || tuxedo --version
2. No fixed release: DOWNGRADE to a release before 12.1.1.0 (Debian / Ubuntu)
apt-cache madison tuxedo
sudo apt install tuxedo=<VERSION_BEFORE_12.1.1.0>
sudo apt-mark hold tuxedo
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list tuxedo
sudo dnf downgrade tuxedo-<VERSION_BEFORE_12.1.1.0>
sudo dnf versionlock add tuxedo
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle exalogic infrastructure DOWNGRADE
Affected: 1.0 · 2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy exalogic-infrastructure || rpm -q exalogic-infrastructure || exalogic-infrastructure --version
2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison exalogic-infrastructure
sudo apt install exalogic-infrastructure=<VERSION_BEFORE_1.0>
sudo apt-mark hold exalogic-infrastructure
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list exalogic-infrastructure
sudo dnf downgrade exalogic-infrastructure-<VERSION_BEFORE_1.0>
sudo dnf versionlock add exalogic-infrastructure
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle peoplesoft enterprise peopletools DOWNGRADE
Affected: 8.53 · 8.54 · 8.55
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.53
1. Check installed version
apt-cache policy peoplesoft-enterprise-peopletools || rpm -q peoplesoft-enterprise-peopletools || peoplesoft-enterprise-peopletools --version
2. No fixed release: DOWNGRADE to a release before 8.53 (Debian / Ubuntu)
apt-cache madison peoplesoft-enterprise-peopletools
sudo apt install peoplesoft-enterprise-peopletools=<VERSION_BEFORE_8.53>
sudo apt-mark hold peoplesoft-enterprise-peopletools
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list peoplesoft-enterprise-peopletools
sudo dnf downgrade peoplesoft-enterprise-peopletools-<VERSION_BEFORE_8.53>
sudo dnf versionlock add peoplesoft-enterprise-peopletools
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
openssl openssl MITIGATE
Affected: 1.0.1 · 1.0.1 beta1 · 1.0.1 beta2 · 1.0.1 beta3 · 1.0.1a · 1.0.1b · 1.0.1c · 1.0.1d
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy openssl || rpm -q openssl || openssl --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
Downgrade not recommended
This is a core system component: downgrading can break the OS. Apply the distro update or the vendor mitigation.
oracle oss support tools DOWNGRADE
Affected: 8.11.16.3.8
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.11.16.3.8
1. Check installed version
apt-cache policy oss-support-tools || rpm -q oss-support-tools || oss-support-tools --version
2. No fixed release: DOWNGRADE to a release before 8.11.16.3.8 (Debian / Ubuntu)
apt-cache madison oss-support-tools
sudo apt install oss-support-tools=<VERSION_BEFORE_8.11.16.3.8>
sudo apt-mark hold oss-support-tools
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list oss-support-tools
sudo dnf downgrade oss-support-tools-<VERSION_BEFORE_8.11.16.3.8>
sudo dnf versionlock add oss-support-tools
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle vm virtualbox DOWNGRADE
Affected: 5.0.16
Fixed in: no fixed release known
Safe to downgrade to: a release before 5.0.16
1. Check installed version
apt-cache policy vm-virtualbox || rpm -q vm-virtualbox || vm-virtualbox --version
2. No fixed release: DOWNGRADE to a release before 5.0.16 (Debian / Ubuntu)
apt-cache madison vm-virtualbox
sudo apt install vm-virtualbox=<VERSION_BEFORE_5.0.16>
sudo apt-mark hold vm-virtualbox
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list vm-virtualbox
sudo dnf downgrade vm-virtualbox-<VERSION_BEFORE_5.0.16>
sudo dnf versionlock add vm-virtualbox
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-3197?
tuxedo: downgrade or apply the listed mitigation; exalogic infrastructure: downgrade or apply the listed mitigation; peoplesoft enterprise peopletools: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2015-3197 being exploited?
CVE-2015-3197 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2015-3197 affect?
CVE-2015-3197 affects tuxedo, exalogic infrastructure, peoplesoft enterprise peopletools. Severity is medium (CVSS 5.9). ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on
How urgent is CVE-2015-3197?
Priority 55/100. EPSS top 4%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
OpenSSL vulnerabilities · VirtualBox vulnerabilities
Related CVEs
- CVE-2018-3007 HIGH 8.6 DOWNGRADE Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
- CVE-2017-10278 HIGH 7.0 DOWNGRADE Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Security)
- CVE-2017-10272 CRITICAL 9.9 DOWNGRADE Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
- CVE-2017-10269 CRITICAL 10.0 DOWNGRADE Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)
- CVE-2017-10267 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core)