{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T11:05:19Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20051012-CVE-2005-2969","slug":"cisco-sa-20051012-cve-2005-2969","vendor":"Cisco","title":"OpenSSL Version Rollback and Weak Cryptographic Algorithm Vulnerabilities","summary":"OpenSSL contains vulnerabilities that could allow an unauthenticated, remote attacker to bypass security restrictions. The first vulnerability (CVE-2005-2969) affects any application using a SL/TLS server implementation provided by OpenSSL versions 0.9.7g and prior.  If these implementations have options designed to mitigate third party bugs enabled, a remote attacker conducting a man-in-the-middle attack could force connections between the hosts to use the 2.0 version of the SSL protocol.  A known cryptographic weaknesses exists in the SSL 2.0 protocol. The second vulnerability (CVE-2005-2946) exists in the default configuration of OpenSSL versions prior to 0.9.8a.  This configuration creates message digests using MD5.  Weaknesses in the cryptographic algorithm could allow a remote attacker to forge certificates with valid certificate authority signatures. OpenSSL confirmed this vulnerability in a security advisory and released updates. Attackers are unlikely to exploit these vulnerabilities due to the man-in-the-middle attack vector.  Such attacks are very difficult to perform due to the requirement of intercepting and modifying traffic between two hosts in real time.  Man-in-the-middle attack are typically only useable by an attacker with physical access to the devices or connections between a customer and service provider. There have been a number of demonstrations recently of weaknesses in the MD5 algorithm.  While MD5 is technically broken, it is not insecure.  It is unlikely that an attacker could successfully create an MD5 collision for use in signing a fake certificate. Administrators should not take particular concern with either of these issues.  Administrators may consider waiting to update productions systems until full testing of the updated version is complete.  If concern of these issues does arise, administrators may consider removing the IE 3.x compatibility flag.","severity":"Medium","published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969/csaf/Cisco-SA-20051012-CVE-2005-2969.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":2,"visible_product_count":7,"public_evidence_count":14,"kev_count":0,"highest_epss":0.04866},"cves":[{"id":"CVE-2005-2969","kev":false,"epss":{"score":0.04866,"percentile":0.91078,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"}},{"id":"CVE-2005-2946","kev":false,"epss":{"score":0.00844,"percentile":0.53922,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"}}],"public_evidence":[{"product":{"name":"Cisco Adaptive Security Appliance (ASA) Software","slug":"cisco-adaptive-security-appliance-asa-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2969"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"7.0.1; 7.0.1.4; 7.0.2; 7.0.3; 7.0.4; 7.0.4.2","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.04866,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":1},{"product":{"name":"Cisco GSS Global Site Selector","slug":"cisco-gss-global-site-selector","vendor":"Cisco"},"cve":{"id":"CVE-2005-2969"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco GSS Global Site Selector","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.04866,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":2},{"product":{"name":"Cisco Mainframe Channel Connection","slug":"cisco-mainframe-channel-connection","vendor":"Cisco"},"cve":{"id":"CVE-2005-2969"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Mainframe Channel Connection","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.04866,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":3},{"product":{"name":"Cisco Wireless Control System (WCS) Software","slug":"cisco-wireless-control-system-wcs-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2969"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Wireless Control System (WCS) Software","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.04866,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":4},{"product":{"name":"CiscoWorks Common Services (CS)","slug":"ciscoworks-common-services-cs","vendor":"Cisco"},"cve":{"id":"CVE-2005-2969"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"CiscoWorks Common Services (CS)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.04866,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":5},{"product":{"name":"Cisco IOS XR Software","slug":"cisco-ios-xr-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2969"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco IOS XR Software","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.04866,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":6},{"product":{"name":"Cisco PIX Firewall Software","slug":"cisco-pix-firewall-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2969"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco PIX Firewall Software","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.04866,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":7},{"product":{"name":"Cisco Adaptive Security Appliance (ASA) Software","slug":"cisco-adaptive-security-appliance-asa-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2946"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"7.0.1; 7.0.1.4; 7.0.2; 7.0.3; 7.0.4; 7.0.4.2","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00844,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":8},{"product":{"name":"Cisco GSS Global Site Selector","slug":"cisco-gss-global-site-selector","vendor":"Cisco"},"cve":{"id":"CVE-2005-2946"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco GSS Global Site Selector","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00844,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":9},{"product":{"name":"Cisco Mainframe Channel Connection","slug":"cisco-mainframe-channel-connection","vendor":"Cisco"},"cve":{"id":"CVE-2005-2946"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Mainframe Channel Connection","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00844,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":10},{"product":{"name":"Cisco Wireless Control System (WCS) Software","slug":"cisco-wireless-control-system-wcs-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2946"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco Wireless Control System (WCS) Software","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00844,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":11},{"product":{"name":"CiscoWorks Common Services (CS)","slug":"ciscoworks-common-services-cs","vendor":"Cisco"},"cve":{"id":"CVE-2005-2946"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"CiscoWorks Common Services (CS)","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00844,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":12},{"product":{"name":"Cisco IOS XR Software","slug":"cisco-ios-xr-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2946"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco IOS XR Software","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00844,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":13},{"product":{"name":"Cisco PIX Firewall Software","slug":"cisco-pix-firewall-software","vendor":"Cisco"},"cve":{"id":"CVE-2005-2946"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T00:31:54Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco PIX Firewall Software","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.00844,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2005-10-12T15:54:57Z","updated_at":"2005-10-12T15:54:57Z","advisory_updated_at":"2005-10-12T15:54:57Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20051012-CVE-2005-2969","row_display_order":14}]}