CVE-2008-7270: OpenSSL

Medium severity, CVSS 4.3. EPSS: 3.4% chance of exploitation in the next 30 days.

OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.

Affected products

• OpenSSL OpenSSL: up to and including 0.9.8i; version 0.9.1c only; version 0.9.2b only; version 0.9.3 only; version 0.9.3a only; version 0.9.4 only; …

Published 2010-12-06. Last modified 2026-06-16.