# CVE-2015-2808

## Summary

- **CVE ID:** CVE-2015-2808
- **Severity:** LOW
- **CVSS Score:** 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **CWE:** N/A
- **Published:** Apr 1, 2015
- **Last Modified:** May 28, 2026

## Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

## Affected Products

- n/a — n/a (n/a)

## References

- [CNA](http://marc.info/?l=bugtraq&m=143818140118771&w=2)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1243.html)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1007.html)
- [CNA](http://marc.info/?l=bugtraq&m=143817899717054&w=2)
- [CNA](http://marc.info/?l=bugtraq&m=144493176821532&w=2)
- [CNA](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1006.html)
- [CNA](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773256)
- [CNA](https://kb.juniper.net/JSA10783)
- [CNA](http://www.securitytracker.com/id/1033737)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html)
- [CNA](http://marc.info/?l=bugtraq&m=144060576831314&w=2)
- [CNA](http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html)
- [CNA](http://www.securitytracker.com/id/1036222)
- [CNA](http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034)
- [CNA](http://www-304.ibm.com/support/docview.wss?uid=swg21960769)
- [CNA](https://security.gentoo.org/glsa/201512-10)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1229.html)
- [CNA](https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04708650)
- [CNA](http://www.securitytracker.com/id/1032600)
- [CNA](http://www.securitytracker.com/id/1032910)
- [CNA](http://www.ubuntu.com/usn/USN-2706-1)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1526.html)
- [CNA](http://marc.info/?l=bugtraq&m=143817021313142&w=2)
- [CNA](http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html)
- [CNA](http://www.securitytracker.com/id/1032599)
- [CNA](http://marc.info/?l=bugtraq&m=144104533800819&w=2)
- [CNA](http://www-304.ibm.com/support/docview.wss?uid=swg21903565)
- [CNA](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190)
- [CNA](https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04711380)
- [CNA](https://kc.mcafee.com/corporate/index?page=content&id=SB10163)
- [CNA](http://marc.info/?l=bugtraq&m=144043644216842&w=2)
- [CNA](http://www.securitytracker.com/id/1032734)
- [CNA](http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892)
- [CNA](https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193347)
- [CNA](http://www.securitytracker.com/id/1033769)
- [CNA](http://www.securitytracker.com/id/1032707)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1091.html)
- [CNA](http://marc.info/?l=bugtraq&m=144069189622016&w=2)
- [CNA](http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1228.html)
- [CNA](http://marc.info/?l=bugtraq&m=144060606031437&w=2)
- [CNA](http://www.securitytracker.com/id/1032708)
- [CNA](http://www.huawei.com/en/psirt/security-advisories/hw-454055)
- [CNA](http://www.debian.org/security/2015/dsa-3316)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html)
- [CNA](http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html)
- [CNA](http://www.securitytracker.com/id/1033415)
- [CNA](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246)
- [CNA](https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098709)
- [CNA](http://marc.info/?l=bugtraq&m=144104565600964&w=2)
- [CNA](http://www-01.ibm.com/support/docview.wss?uid=swg21883640)
- [CNA](http://marc.info/?l=bugtraq&m=144102017024820&w=2)
- [CNA](http://www.securitytracker.com/id/1033432)
- [CNA](http://marc.info/?l=bugtraq&m=143629696317098&w=2)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html)
- [CNA](http://www.securitytracker.com/id/1032858)
- [CNA](https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04687922)
- [CNA](http://www.securitytracker.com/id/1032788)
- [CNA](http://www.ubuntu.com/usn/USN-2696-1)
- [CNA](https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf)
- [CNA](http://www.debian.org/security/2015/dsa-3339)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1020.html)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1242.html)
- [CNA](http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727)
- [CNA](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html)
- [CNA](http://www.securitytracker.com/id/1033431)
- [CNA](http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454055.htm)
- [CNA](https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988)
- [CNA](http://www.securitytracker.com/id/1032868)
- [CNA](http://marc.info/?l=bugtraq&m=144059703728085&w=2)
- [CNA](http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html)
- [CNA](http://www.securityfocus.com/bid/91787)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1241.html)
- [CNA](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140)
- [CNA](http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1230.html)
- [CNA](https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888)
- [CNA](http://marc.info/?l=bugtraq&m=143456209711959&w=2)
- [CNA](http://www.securitytracker.com/id/1033386)
- [CNA](http://marc.info/?l=bugtraq&m=143741441012338&w=2)
- [CNA](http://www.securitytracker.com/id/1033072)
- [CNA](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html)
- [CNA](https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119)
- [CNA](http://rhn.redhat.com/errata/RHSA-2015-1021.html)
- [CNA](http://www-304.ibm.com/support/docview.wss?uid=swg21960015)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html)
- [CNA](https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html)
- [CNA](http://marc.info/?l=bugtraq&m=144059660127919&w=2)
- [CNA](http://www.securityfocus.com/bid/73684)
- [CNA](http://www.securitytracker.com/id/1032990)
- [CNA](http://www.securitytracker.com/id/1033071)
- [CNA](http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html)
- [CNA](https://www.secpod.com/blog/cve-2015-2808-bar-mitzvah-attack-in-rc4-2/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 32.29%
- **EPSS Percentile:** 96.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-20._