Archived Content
In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.SSLv2 DROWN Attack
Last Revised
Network traffic encrypted using an RSA-based SSL certificate may be decrypted if enough SSLv2 handshake data can be collected. Exploitation of this vulnerability—referred to as DROWN in public reporting—may allow a remote attacker to decrypt individual messages from a server supporting SSLv2.
US-CERT encourages users and administrators to review Vulnerability Note VU#583776 and the US-CERT OpenSSL Current Activity for additional information and mitigation details.
This product is provided subject to this Notification and this Privacy & Use policy.