CVE-2020-1968

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

• CWE-203
• CWE-203

• https://lists.debian.org/debian-lts-announce/2020/09/msg00016.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-02Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200911-0004/Third Party Advisory
• https://usn.ubuntu.com/4504-1/Third Party Advisory
• https://www.openssl.org/news/secadv/20200909.txtVendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00016.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202210-02Third Party Advisory
• https://security.netapp.com/advisory/ntap-20200911-0004/Third Party Advisory
• https://usn.ubuntu.com/4504-1/Third Party Advisory
• https://www.openssl.org/news/secadv/20200909.txtVendor Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2021.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Sep 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-19669Cross Site Request Forgery (CSRF) vulnerability exists in Ey…8.8
• CVE-2020-1967Server or client applications that call the SSL_check_chain(…7.5
• CVE-2020-19670In Niushop B2B2C Multi-Business Basic Edition V1.11, authent…4.9
• CVE-2020-19672Niushop B2B2C Multi-business basic version V1.11, can bypass…9.8
• CVE-2020-19676Nacos 1.1.4 is affected by: Incorrect Access Control. An env…5.3
• CVE-2020-19678Directory Traversal vulnerability found in Pfsense v.2.1.3 a…7.5
• CVE-2020-19682A Cross Site Request Forgery (CSRF) vulnerability exits in Z…8.8
• CVE-2020-19683A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an …5.4
• CVE-2020-1969Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-19692Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 al…9.8
• CVE-2020-19693An issue found in Espruino Espruino 6ea4c0a allows an attack…9.8
• CVE-2020-19695Buffer Overflow found in Nginx NJS allows a remote attacker …9.8