CVE-2020-1968: Canonical Ubuntu Linux

Low severity, CVSS 3.7. EPSS: 4.9% chance of exploitation in the next 30 days.

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

Affected products

Canonical Ubuntu Linux: version 16.04 only; version 18.04 only
Debian Debian Linux: version 9.0 only
Fujitsu m10-1 Firmware: before xcp2400 (fixed in xcp2400); before xcp3100 (fixed in xcp3100)
Fujitsu m10-4 Firmware: before xcp2400 (fixed in xcp2400); before xcp3100 (fixed in xcp3100)
Fujitsu m10-4s Firmware: before xcp2400 (fixed in xcp2400); before xcp3100 (fixed in xcp3100)
Fujitsu m12-1 Firmware: before xcp2400 (fixed in xcp2400); before xcp3100 (fixed in xcp3100)
Fujitsu m12-2 Firmware: before xcp2400 (fixed in xcp2400); before xcp3100 (fixed in xcp3100)
Fujitsu m12-2s Firmware: before xcp2400 (fixed in xcp2400); before xcp3100 (fixed in xcp3100)
OpenSSL OpenSSL: from 1.0.2, up to and including 1.0.2v
Oracle Ethernet Switch ES1-24 Firmware: version 1.3.1 only
Oracle Ethernet Switch ES2-64 Firmware: version 2.0.0.14 only
Oracle Ethernet Switch ES2-72 Firmware: version 2.0.0.14 only
Oracle Ethernet Switch Tor-72 Firmware: version 1.2.2 only
Oracle Jd Edwards World Security: version a9.4 only
Oracle PeopleSoft Enterprise PeopleTools: version 8.56 only; version 8.57 only; version 8.58 only

Published 2020-09-09. Last modified 2026-06-17.