CVE-2010-4180: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 9.5% chance of exploitation in the next 30 days.

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 9.04 only; version 10.04 only; version 10.10 only
• Debian Debian Linux: version 5.0 only
• F5 Nginx: before 0.9.2 (fixed in 0.9.2)
• Fedoraproject Fedora: version 13 only; version 14 only
• OpenSSL OpenSSL: before 0.9.8q (fixed in 0.9.8q); from 1.0.0, before 1.0.0c (fixed in 1.0.0c)
• Opensuse Opensuse: version 11.1 only; version 11.2 only; version 11.3 only; version 11.4 only
• Suse Linux Enterprise: version 11.0 only
• Suse Linux Enterprise Desktop: version 10 only; version 11 only
• Suse Linux Enterprise Server: version 9 only; version 10 only

Published 2010-12-06. Last modified 2026-06-16.